Operational Technology at Risk: FortiBleed Campaign Harvests 110 Million Credentials from FortiGate Firewalls
Executive Summary
A highly significant, cross-sector cybersecurity threat campaign known as FortiBleed has been uncovered systematically targeting FortiGate firewall and VPN appliances positioned at the critical boundary between corporate Information Technology (IT) and Operational Technology (OT) networks. Formally detailed in a comprehensive threat report on July 13, 2026, by cybersecurity firm CYFIRMA, the campaign involves the active, automated harvesting of administrative and user credentials from internet-exposed appliances. Threat actors successfully exploited a large-scale credential leakage and administrative configuration bypass affecting approximately 73,000 to 74,000 FortiGate devices globally.
Using a highly optimized, custom Golang-based credential harvester, the attackers systematically connected to these devices, exfiltrating approximately 110 million valid credentials by late June 2026. Because FortiGate appliances are widely utilized in manufacturing, energy, and utility sectors to enforce network segmentation, the campaign presents a direct and extreme threat to critical industrial control systems (ICS).
Deep-Dive Technical Analysis
In industrial and manufacturing environments, Operational Technology (OT) networks dictate the physical control of machinery, assembly lines, power grids, and SCADA (Supervisory Control and Data Acquisition) systems. To protect these critical physical operations from internet-based threats, organizations deploy firewalls and VPN appliances (such as FortiGate) to enforce strict network segmentation between the public-facing corporate IT subnet and the private OT subnet. However, if these perimeter appliances are compromised, they transform from protective barriers into centralized gateways that attackers can exploit to bypass all downstream security controls.
A technical analysis of the FortiBleed campaign and its Golang-based orchestration reveals a highly organized and automated exploitation model:
1. The Vulnerable Perimeter (The Entry Vector): Threat actors targeted approximately 73,000 to 74,000 FortiGate appliances that had been left internet-exposed. The campaign exploited a severe administrative configuration bypass or unpatched session-handling flaw that allowed remote, unauthenticated attackers to query internal system directories.
2. The Custom Golang Credential Harvester: To execute the compromise at an unprecedented scale, the attackers developed a highly optimized, custom multi-threaded tool compiled in Golang. Golang's native support for rapid concurrent execution (via goroutines) makes it the ideal language for constructing large-scale network scanning tools.
3. Automated Credential Exfiltration: The Golang harvester systematically connects to the public IP addresses of the targeted FortiGate devices, bypasses the local authentication wall, and queries the local user authentication databases. The tool extracts:
* Active Directory and LDAP credentials: Used by corporate employees and administrators to access the local network.
* VPN and SSL-VPN credentials: Stored user profiles and passwords used for remote work access.
* API Tokens and SSH keys: Stored configuration keys used to manage the firewalls.
4. Bypassing the IT/OT Air-Gap: Once the attackers exfiltrated the 110 million credentials, they utilized valid administrative logins to connect to the targeted FortiGate VPN portals. Because these firewalls are positioned directly at the IT/OT boundary, hijacking an admin session allows the threat actors to silently disable network segmentation rules, construct unauthorized VPN tunnels, and move laterally directly into the connected OT subnet, exposing sensitive programmable logic controllers (PLCs) to remote manipulation or sabotage.
Industry Impact and Recommendations
The FortiBleed campaign demonstrates that perimeter firewalls represent single-points-of-failure if left unpatched or unprotected by strict zero-trust controls. When a single security campaign can harvest over 110 million credentials from critical edge devices, organizations must immediately re-evaluate their IT/OT boundary security.
We recommend that all network engineers, manufacturing CISOs, and OT security architects implement the following immediate mitigations:
1. Apply FortiGate Security Patches Immediately: Ensure that all FortiGate appliances, VPN gateways, and edge routers are updated to the latest, vendor-supported firmware versions. Prioritize patching devices that are publicly accessible.
2. Audit and Rotate All Associated Credentials: Conduct a comprehensive, network-wide credential audit. Immediately reset and rotate all administrative passwords, VPN user accounts, LDAP credentials, API tokens, and SSH keys associated with your FortiGate devices to neutralize the utility of any harvested datasets.
3. Enforce Rigid Multi-Factor Authentication (MFA): Secure all remote SSL-VPN connections, administrative consoles, and remote access portals behind mandatory, phishing-resistant multi-factor authentication (such as physical FIDO2 keys), ensuring that stolen passwords cannot be successfully exploited.
4. Implement Strict IP Whitelisting and Geofencing: Restrict access to all FortiGate administrative interfaces. Configure external firewall rules to only permit incoming administrative traffic originating from verified, corporate-approved IP addresses or secure Zero-Trust Network Access (ZTNA) gateways.
5. Continuous OT/ICS Monitoring: Deploy advanced anomaly detection tools inside your OT subnet. Configure rules to instantly flag, alert, and block any unusual, uncharacteristic, or lateral traffic originating from the IT/OT boundary firewalls.
References:
* Industrial Cyber — CYFIRMA warns nation-state actors are increasing attacks on manufacturing, OT, and ICS environments
* Cisco — Security Advisories and Alerts