Credential-Harvesting Campaign Compromises 30,000 Fortinet Firewalls

A large-scale credential-harvesting campaign has compromised more than 30,000 Fortinet FortiGate firewalls and VPN gateways across 194 countries, according to SOCRadar, which said the attackers amassed a database of 30,791 verified working credentials. Researchers said the operation targeted internet-facing Fortinet management and VPN interfaces using credential stuffing, password spraying, brute-force attempts, and reused passwords from prior leaks, and found no evidence of a Fortinet zero-day or a breach of Fortinet itself.

The attackers allegedly used compromised devices as listening posts to capture additional credentials and feed them into an automated attack chain, broadening access across sectors including telecommunications, government, healthcare, finance, education, energy, and other critical infrastructure. Telecom was reported as the most affected sector, while government entities accounted for 591 entries across 111 domains; India and the United States represented nearly one-third of identified compromises. SOCRadar said the campaign remained active and assessed it as critical, with tooling and victim selection described as consistent with Russian-speaking threat actors and possible motives spanning both financial gain and cyberespionage.