FortiBleed: A Global Intrusion Campaign Targeting Fortinet Edge Infrastructure

Behind FortiBleed: The Credential Harvesting Operation That Targeted Enterprise Security Gateways

A large-scale and continuously evolving cyber intrusion campaign targeting Fortinet network infrastructure has been identified, affecting internet-facing security appliances and remote access gateways deployed across organizations worldwide. Referred to as “FortiBleed,” the campaign demonstrates a sophisticated blend of credential compromise, automated attack techniques, and active exploitation of exposed vulnerabilities to gain unauthorized access and establish long-term persistence within enterprise environments.

Unlike traditional attacks that depend on a single vulnerability or attack vector, FortiBleed operates as a persistent access operation. Threat actors leverage a combination of stolen credentials, automated discovery mechanisms, brute-force activity, and compromised authentication artifacts to repeatedly target vulnerable systems. Once initial access is obtained, attackers attempt to expand their foothold by moving laterally through internal networks, targeting additional systems, accounts, and critical services.

The scale and automation behind this operation make it particularly concerning. The campaign has impacted a significant number of organizations across multiple industries and geographic regions, including enterprises, government entities, and critical infrastructure providers. The widespread targeting of perimeter security devices highlights the increasing focus attackers place on edge infrastructure as a gateway into protected environments.

Organizations operating Fortinet appliances are advised to conduct immediate exposure assessments, review authentication activity, validate device configurations, and investigate indicators of compromise associated with unauthorized access attempts. Security teams can leverage available verification mechanisms, including the FortiBleed Tool Checker, to determine potential exposure and support proactive remediation efforts.

As threat actors continue adapting their techniques, ‘FortiBleed’ serves as a reminder that internet-facing security controls must be continuously monitored, hardened, and treated as high-value assets within an organization’s defensive strategy.

How did the ‘Fortibleed’ campaign affect the companies in Sri Lanka

A major telecommunications service provider and Internet Service Provider (ISP) in Sri Lanka was among the organizations impacted by this campaign, highlighting the severity and real-world consequences of targeting exposed edge infrastructure. The affected Fortinet firewalls were directly accessible from the public internet, meaning that any threat actor possessing valid credentials or leveraging an available exploit path could potentially gain unauthorized administrative access.

Compromise of these perimeter security devices could provide adversaries with a direct entry point into an organization’s internal network environment. Once inside, attackers may be able to perform reconnaissance, move laterally across systems, access sensitive resources, establish persistence, and potentially disrupt critical business operations.

Several other enterprises across Sri Lanka were also impacted by this credential harvesting campaign, further demonstrating the widespread nature of the operation and the growing threat against exposed security infrastructure. The targeting of these organizations highlights how threat actors are increasingly focusing on obtaining valid credentials as a means of bypassing traditional security controls and gaining trusted access to enterprise environments.

During the investigation phase, publicly accessible Fortinet firewall management interfaces were identified through external reconnaissance. Each discovered exposed login portal was manually reviewed and validated, and the findings confirmed that the identified instances were genuine exposures rather than false positives. This highlights the significant risk associated with internet-facing firewall administration interfaces, where unauthorized access attempts, credential compromise, or exploitation of known vulnerabilities could potentially provide attackers with direct access to enterprise security boundaries.

Attack Methodology and Initial Access

The FortiBleed campaign demonstrates how exposed perimeter devices have become a primary target for modern threat actors. Internet-facing firewalls and VPN gateways represent the first security boundary between an organization and the external world; therefore, any weakness within these systems can provide attackers with a highly valuable entry point.

The attackers involved in this campaign appear to have followed a multi-stage intrusion approach. The initial phase involved identifying publicly accessible Fortinet appliances through internet-wide scanning and reconnaissance activities. Once exposed devices were discovered, threat actors attempted multiple access techniques, including the use of compromised administrative credentials, password-based attacks, and exploitation of known security weaknesses affecting vulnerable firmware versions.

After successfully authenticating or exploiting the device, adversaries could gain privileged access to the firewall management interface. This level of access is particularly dangerous because the firewall is responsible for controlling traffic flow, enforcing security policies, and often maintaining VPN connectivity into internal environments.

Post-Compromise Activity

Following successful compromise of a Fortinet firewall, attackers may attempt to establish persistence to maintain long-term access. This can include creating unauthorized administrator accounts, modifying firewall policies, changing VPN configurations, disabling security controls, or altering logging mechanisms to reduce visibility.

The compromised firewall can then act as a strategic pivot point into the internal network. From this position, attackers can perform internal reconnaissance, identify critical servers, enumerate user accounts, and search for additional credentials. In enterprise environments, this can potentially lead to further compromise of Active Directory services, databases, cloud resources, and other mission-critical systems.

Why Fortinet Edge Devices Are High-Value Targets

Security appliances such as firewalls and VPN concentrators are attractive targets because they sit at the intersection of external connectivity and internal trust. Unlike traditional endpoints, these devices often have direct network visibility across multiple segments and maintain privileged access to organizational infrastructure.

A compromised firewall does not simply represent the compromise of a single system; it can effectively represent the compromise of an organization’s entire security perimeter. Attackers who gain control of these devices may be able to bypass traditional endpoint protections because their activity originates from trusted network infrastructure.

Enterprise Impact

The impact of this campaign extends beyond unauthorized access. Organizations affected by FortiBleed-related activity may face risks including:

• Unauthorized access to internal networks
• Exposure of sensitive corporate data
• Credential theft and account compromise
• Deployment of additional malware or backdoors
• Lateral movement into critical systems
• Operational disruption
• Potential ransomware deployment

For telecommunications providers and large enterprises, the consequences can be significantly greater due to the scale of their infrastructure and the number of connected customers, employees, and third-party services.

Detection and Investigation

Security teams investigating potential exposure should focus on identifying unusual firewall activity, unexpected administrative access, and changes to device configuration. Key indicators may include:

• New or unauthorized administrator accounts
• Suspicious VPN authentication attempts
• Login activity from unfamiliar geographic locations
• Unexpected firewall rule modifications
• Configuration changes outside approved maintenance windows
• Disabled logging or monitoring functions

A compromised edge device should be treated as a high-severity security incident because attackers may have already accessed internal resources before detection.