Operation FortiBleed: Fortinet SSL VPN Credential Harvesting & GPU Cracking Infrastructure

The "FortiBleed" campaign represents a sophisticated, large-scale credential compromise operation specifically targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. Threat intelligence derived from an exposed attacker infrastructure reveals a well-resourced operation leveraging approximately 36 rented GPUs within a distributed cracking framework (Hashtopolis).

The attackers utilize a multi-vector approach to credential theft, combining brute force attacks, credential stuffing, and offline hash cracking. The objective appears to be initial access brokering—harvesting valid VPN credentials to sell on dark web forums or to facilitate follow-on intrusions. The campaign has shown global reach, with significant telemetry indicating victims in the United States, India, Mexico, Taiwan, and Colombia.

Threat Actor / Malware Profile

Adversary Identity: Currently Unknown (Opportunistic Access Broker)
Tools & Infrastructure:
- Hashtopolis: A distributed password cracking client used to manage the 36 GPU cluster, likely used to crack captured Fortinet hashes or password dumps efficiently.
- Open Directory: The attackers inadvertently exposed an open directory containing 319 files, including scripts, target lists, and potentially harvested credentials, providing deep insight into their operational security (OpSec) failures.
Distribution Method: Direct internet scanning targeting Fortinet SSL-VPN interfaces (typically ports 443, 10443).
Attack Chain:
1. Reconnaissance: Identify internet-facing FortiGate devices.
2. Initial Access: Conduct brute force or credential stuffing attacks against SSL VPN portals.
3. Credential Harvesting: If successful, export credentials or hash dumps.
4. Cracking: Utilize the Hashtopolis GPU farm to crack weak passwords or hashes.
5. Monetization: Sell valid access on dark web markets.
Persistence: While no specific malware payload was identified, persistence is achieved through legitimate user account creation or modification of existing VPN configurations on compromised firewalls.

IOC Analysis

While the specific file hashes were restricted in the initial pulse, the attack profile relies heavily on network-level indicators and behavioral patterns.

Indicator Types: Expect to see aggressive scanning IPs, known Hashtopolis agent IPs, and specific user-agent strings used in brute-forcing tools.
Operationalization: SOC teams should prioritize importing identified scanner IPs into firewall blocklists. However, due to the distributed nature of the attack, behavior-based detection (high failed auth counts) is more reliable than static IOCs.
Decoding Tools: Standard log analysis tools (Splunk, ELK) parsing FortiOS system logs should be tuned to identify msg="Login failed" events correlated with geographic anomalies.

Detection Engineering

Sigma rules are provided to detect the brute force activity and the potential presence of cracking tooling or anomalous logins associated with the FortiBleed campaign.

YAML

title: Fortinet SSL VPN Brute Force Attempt
id: 4a8b0c9d-1e2f-3a45-6b7c-8d9e0f1a2b3c
description: Detects multiple failed login attempts on Fortinet SSL VPN indicative of the FortiBleed brute force campaign.
status: experimental
date: 2026/07/19
author: Security Arsenal
references:
    - https://www.cloudsek.com/blog/inside-the-fortibleed-open-directory-a-technical-analysis-of-what-the-attacker-left-behind
tags:
    - attack.initial_access
    - attack.brute_force
    - fortinet
    - fortibleed
logsource:
    product: fortinet
    service: firewall
    definition: 'Requirements: FortiGate logs must be forwarded to the SIEM.'
detection:
    selection:
        action: 'accept'
        service: 'sslvpn'
        msg|contains:
            - 'Login failed'
            - 'Authentication failed'
    filter_main_admin:
        user|startswith: 'admin' # Optional: filter out admin noise if not targeted
    condition: selection | count() by src_ip > 20
falsepositives:
    - Legitimate users forgetting passwords
    - Misconfigured VPN clients
level: high
---
title: Potential Hashtopolis Cracking Tool Execution
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
description: Detects execution of known password cracking binaries associated with Hashtopolis or hash cracking infrastructure on Windows endpoints.
status: experimental
date: 2026/07/19
author: Security Arsenal
references:
    - https://www.cloudsek.com/blog/inside-the-fortibleed-open-directory-a-technical-analysis-of-what-the-attacker-left-behind
tags:
    - attack.credential_access
    - attack.t1110.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\hashcat.exe'
        - Image|endswith: '\hashtopolis.exe'
        - Image|endswith: '\oclHashcat.exe'
    selection_cli:
        CommandLine|contains:
            - '-m 1600' # FortiOS hash mode often used
            - '-m 2100' # Domain Cached Credentials
            - 'hashtopolis'
    condition: 1 of selection*
falsepositives:
    - Authorized penetration testing
    - Security auditing by IT staff
level: critical
---
title: FortiGate Admin Login from High Risk Geography
id: c2d3e4f5-6a7b-8c9d-0e1f-2a3b4c5d6e7f
description: Detects successful FortiGate administrative or VPN logins from countries identified in the FortiBleed telemetry.
status: experimental
date: 2026/07/19
author: Security Arsenal
references:
    - https://www.cloudsek.com/blog/inside-the-fortibleed-open-directory-a-technical-analysis-of-what-the-attacker-left-behind
tags:
    - attack.initial_access
    - fortinet
logsource:
    product: fortinet
    service: firewall
detection:
    selection:
        action: 'accept'
        msg|contains: 'Login successful'
    geo:
        src_geo_country:
            - 'United States' # Context dependent: if org is not US based
            - 'British Indian Ocean Territory'
            - 'Colombia'
            - 'India'
            - 'Mexico'
            - 'Taiwan'
    condition: selection and geo
falsepositives:
    - Legitimate remote workforce in listed countries
level: medium

KQL (Microsoft Sentinel)

This query hunts for spikes in failed authentication attempts against Fortinet devices, a key signature of the FortiBleed brute force component.

KQL — Microsoft Sentinel / Defender

DeviceNetworkEvents
| where ActionType == "ConnectionFailed" or ActionType == "InboundConnectionBlocked"
| where RemotePort in (443, 10443) // Common SSL VPN ports
| where DeviceVendor contains "Fortinet"
| summarize FailedLogins = count() by SrcIp, bin(Timestamp, 15m)
| where FailedLogins > 50
| extend IOCLink = strcat("https://otx.alienvault.com/indicator/ip/", SrcIp)
| sort by FailedLogins desc

PowerShell Hunt Script

This script checks the local Windows Event Logs (assuming the VPN authenticates against AD/RADIUS) or exported FortiGate logs for signs of brute force attacks targeting Fortinet-specific user agents or error patterns.

PowerShell

<#
.SYNOPSIS
    Hunt script for FortiBleed Brute Force Indicators in Windows Event Logs.
.DESCRIPTION
    Parses Security Event Logs (Event ID 4625) for high frequency failures
    potentially correlated with Fortinet VPN authentication.
#>

$TargetEvents = Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4625)]]" -ErrorAction SilentlyContinue

if ($TargetEvents) {
    $FailedLogins = $TargetEvents | 
        Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-24) } | 
        Group-Object { $_.Properties[5].Value } # Group by Source IP
    
    $SuspiciousActivity = $FailedLogins | Where-Object { $_.Count -gt 20 } 

    if ($SuspiciousActivity) {
        Write-Host "[!] Potential FortiBleed Brute Force Detected:" -ForegroundColor Red
        foreach ($entry in $SuspiciousActivity) {
            Write-Host "Source IP: $($entry.Name) | Failed Attempts: $($entry.Count)"
        }
    } else {
        Write-Host "[-] No high-volume failed logins detected in the last 24 hours." -ForegroundColor Green
    }
} else {
    Write-Host "[-] No Event ID 4625 found."
}

Response Priorities

Immediate:
- Block IPs identified in the KQL hunt or Sigma alerts at the firewall edge.
- Enforce Multi-Factor Authentication (MFA) on all Fortinet SSL-VPN portals immediately to mitigate credential reuse.
- Review and lock out accounts with excessive failed login attempts.
24 Hours:
- Conduct a credential audit for all privileged VPN accounts. Reset passwords for any accounts that appeared in the "successful login" logs from anomalous geolocations.
- Verify that no unauthorized configuration changes (like new local users or SSH key additions) were made on FortiGate devices during the compromise window.
1 Week:
- Review the architecture of internet-facing firewalls to ensure SSL-VPN is not exposed unnecessarily.
- Implement "Geo-Blocking" on FortiGate devices to restrict access to only countries where business operations exist, specifically filtering out the regions mentioned in the threat report if not applicable.
- Hunt internally for Hashtopolis agents or hash-cracking tools on internal workstations (Detection Pack #2).

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub