Inside the FortiBleed Open Directory: A Technical Analysis of What the Attacker Left Behind

Date: 06/22/2026

Severity: Critical

Summary

FortiBleed is a large-scale credential compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways using stolen and cracked credentials rather than a software vulnerability. Researchers uncovered the operation after threat actors accidentally exposed an open directory containing validated credentials, attack tooling, automation scripts, and operational logs. The findings provide rare insight into the attackers’ infrastructure, revealing a coordinated effort to gain unauthorized access to Fortinet devices at scale.

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Reference:    

https://www.cloudsek.com/blog/inside-the-fortibleed-open-directory-a-technical-analysis-of-what-the-attacker-left-behind