New Cyber Threat Exploits FortiGate Firewalls, Collecting Millions of Credentials

In an alarming development for organizations worldwide, a financially motivated hacking group has effectively developed and deployed a malicious tool, known as FortigateSniffer. This custom-built Golang application has infiltrated over 430,000 FortiGate firewalls globally, resulting in the unauthorized collection of over 110 million user credentials since its emergence in February 2026. The implications of this attack are significant, presenting serious challenges to network security integrity across various sectors, including defense.

A Closer Look at the FortiBleed Campaign

The recently identified campaign, dubbed FortiBleed, has drawn the attention of cybersecurity experts, particularly the Threat Research Unit (STRU) at SOCRadar. This group has highlighted the extensive reach of the FortigateSniffer tool and its ability to silently harvest credentials—an action that poses a substantial risk to sensitive information and network security.

How the Attack Unfolds

FortigateSniffer leverages vulnerabilities in FortiGate firewalls, which are widely used by enterprises to manage network security. Once infiltrated, the tool enables attackers to collect sensitive data, including login credentials, without being detected. The attack has primarily focused on corporate networks, putting organizations that rely on these firewalls in jeopardy.

Who Are the Targets?

• Financial institutions
• Healthcare providers
• Government agencies
• Defense contractors, including NATO-aligned firms

The wide array of potential targets underscores the need for urgent action from organizations that utilize FortiGate products. The potential for data exfiltration and subsequent exploitation of sensitive information makes it imperative for these organizations to reassess their security protocols.

The Alarm Bells: Why This Matters Now

For organizations worldwide, the emergence of the FortiBleed campaign should serve as a wake-up call. As cyber threats evolve in sophistication, traditional security measures may no longer suffice. The fallout from credential theft can have devastating consequences, ranging from financial losses to significant reputational damage.

Immediate Steps for Protection

In the face of this new threat, cybersecurity experts recommend that organizations take the following proactive measures:

• Update Firmware: Ensure that FortiGate firewalls are running the latest firmware to mitigate known vulnerabilities.
• Regular Audits: Conduct frequent security audits to identify and rectify potential weaknesses in your network.
• Implement Multi-Factor Authentication (MFA): Adding an extra layer of security can help protect against unauthorized access.
• Monitor Network Traffic: Keep an eye on unusual activities to spot potential breaches early.

Understanding the Long-Term Implications

The FortiBleed campaign could set a precedent for future attacks, highlighting vulnerabilities in widely used network security devices. As attackers continue to refine their techniques, organizations may find it increasingly challenging to safeguard against new threats.

Broader Industry Impact

The ramifications of such attacks extend beyond immediate data loss. For industries reliant on secure communications and data handling, the potential for operational disruptions could lead to long-term impacts. Moreover, the trust that consumers place in organizations could deteriorate as news of these breaches circulates, compelling businesses to invest heavily in cybersecurity improvements.

Conclusion: A Call to Action

The revelation of the FortigateSniffer attacks underscores a pivotal moment in the cybersecurity landscape. Organizations must act decisively to protect their networks and data. As the threat of credential theft looms larger, staying informed and proactive in enhancing security measures is not just advisable; it is essential. The time to act is now—secure your network before it becomes a victim of this evolving cyber threat.

Home » News