FortiBleed shows why credential harvesting breaks Fortinet trust models

At a glance

What this is: This is Orca Security’s analysis of the FortiBleed campaign, which used Fortinet exposure and an EMS access-control flaw to harvest credentials and drive ransomware activity.

Why it matters: It matters because security teams managing NHI, privileged access, and remote access infrastructure need to treat credential interception and standing administrative trust as primary governance failures, not just patching problems.

By the numbers:

• Attackers gained admin-level access on 409 targets.
• CVE-2026-35616 has a CVSS score of 9.1.

Context

FortiBleed is a credential-harvesting campaign that turned internet-facing Fortinet infrastructure into a trust-breaking collection point for administrative secrets. The core issue is not only the vulnerability in FortiClient EMS, but the way exposed management planes can be used to intercept authentication traffic and convert that access into broader control.

For IAM and NHI teams, this is a reminder that remote access infrastructure is also identity infrastructure. When VPN, RADIUS, NTLM, Kerberos, and admin credentials can be captured passively, patching one component does not restore the trust model unless credential scope, administrative access, and exposure paths are also reset.

The article describes a large-scale, active campaign with ransomware follow-on activity, so the starting position is atypical in scale but familiar in pattern. The mechanics are the same failure modes that appear in many environments, only amplified across FortiGate-managed estates.

Key questions

Q: What breaks when FortiGate credentials can be harvested passively?

A: Passive capture breaks the assumption that credentials are only exposed at login time. If authentication traffic can be intercepted across VPN and directory protocols, the attacker does not need to phish users or defeat endpoint controls first. The control failure is that network-management platforms can become credential collection points before anyone notices misuse.

Q: Why do internet-facing control planes create such a large identity and security risk?

A: They concentrate privilege, configuration authority, and secrets in one reachable place. If that surface is compromised, the attacker inherits not only server access but also the trust context that systems, users, and customers place in the host. That makes exposure management a governance issue, not only a patching task.

Q: How can security teams tell whether Fortinet exposure is being abused?

A: Look for unexplained admin account activity, unexpected packet-sniffer behaviour, abnormal EMS configuration changes, and indicators tied to the reported FortigateSniffer tooling. Teams should also treat traffic to known C2 infrastructure and Tor-related egress as a sign that credential harvesting may already be underway, not merely attempted.

Q: What should organisations do immediately after a FortiClient EMS compromise?

A: Contain the management plane, rotate all credentials that may have traversed it, and validate administrative account integrity before re-enabling normal access. The key question is whether the attacker could have modified remote access profiles or injected scripts, because that changes the response from patching to full identity reset.

Technical breakdown

How credential interception turns management planes into collection points

FortiBleed shows how an exposed network-management stack can become a credential collection layer rather than a pure control plane. The attackers reportedly abused FortiOS’s native packet sniffing capability to passively observe authentication traffic across multiple protocols, including RADIUS, NTLM, and Kerberos. That matters because passive collection avoids noisy login failures and can harvest reusable secrets from normal administrative and remote-access flows. Once the attacker can observe traffic at the device layer, identity controls that depend on endpoint-side detection or user-side MFA prompts are bypassed as a practical matter.

Practical implication: treat management-plane sniffing capability as a credential-exposure path and restrict who can reach it.

Why standing administrative trust becomes a compromise multiplier

The campaign moved from interception to admin access on dozens of targets, then into full domain compromise in many cases. That progression shows the danger of standing privilege on infrastructure that already brokers trust for other systems. Admin accounts on firewalls, EMS platforms, and remote-access services often hold broad reach over authentication, routing, and configuration. When those accounts are reachable from the internet or not tightly segmented, credential capture turns into durable administrative control very quickly. In NHI terms, the problem is not only secret theft but the oversized blast radius of the account that secret unlocks.

Practical implication: reduce management-plane blast radius by constraining administrative accounts and segregating them from general access paths.

Why improper access control in EMS changes the threat model

CVE-2026-35616 matters because the issue is described as improper access control, not merely a bug in a peripheral tool. That means the affected EMS platform can be used to alter remote access profiles and inject malicious code into configuration workflows without the normal identity checks holding the line. In practice, this moves the risk from isolated vulnerability exploitation to identity-governance failure, because the attacker can use legitimate management workflows to distribute malicious changes. The trust assumption that a management channel only carries authorised configuration no longer holds once the control plane itself is reachable by an attacker.

Practical implication: validate authorisation boundaries on remote-access management channels, not just the endpoint host running them.

Threat narrative

Attacker objective: The attackers aimed to harvest reusable credentials and convert Fortinet trust relationships into privileged access that could be monetised through ransomware operations.

1. Entry began with internet-wide scanning of FortiGate exposure and active exploitation of CVE-2026-35616 in FortiClient EMS.
2. Credential access followed through passive interception of authentication traffic with a custom packet sniffer, including RADIUS, NTLM, and Kerberos traffic.
3. Escalation occurred as stolen credentials enabled admin-level access on targeted environments and spread through FortiGate-managed infrastructure.
4. Impact included domain compromise, ransomware deployments, and broader infrastructure control across victim estates.

Breaches seen in the wild

• JADEPUFFER agentic ransomware 2026: The first documented agentic ransomware used harvested keys, default MinIO credentials and a default Nacos signing key to wipe a database.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

FortiBleed is a trust-model failure, not just a vulnerability story: the breach path matters because attackers used exposed Fortinet infrastructure to turn management traffic into credential harvest. The practical lesson is that remote access and management planes are identity systems in their own right, so their exposure has to be governed as such. Organisations that treat this as a patch-only event will miss the real control failure.

Passive credential capture is a governance problem because it defeats visibility-based controls: when authentication traffic can be observed in transit, access reviews and detective controls arrive too late to prevent misuse. The credentials were harvested without triggering traditional intrusion detection, which shows why runtime trust boundaries matter more than post-event audit trails. Practitioners should see this as a reminder that visibility is not containment.

FortiBleed exposes the danger of administrative accounts with outsized blast radius: once stolen credentials translate into admin-level access on firewalls or EMS platforms, the attacker inherits the trust relationships of the whole environment. That is a classic overprivilege pattern, but in this case it is amplified by infrastructure that brokers remote access for the enterprise. The governance implication is that administrative identity on network control planes needs stricter lifecycle and scope controls than ordinary privileged access.

Credential harvesting at this scale creates identity blast radius across multiple protocols: the operation reportedly collected more than 110 million credentials by intercepting RADIUS, NTLM, and Kerberos traffic. That breadth shows why protocol-specific secret handling cannot be separated from platform exposure and segmentation decisions. The right mental model is not a single compromised account but a cascading trust collapse across the access stack.

FortiBleed shows why NHI governance and network security can no longer be separated cleanly: firewall admin accounts, VPN credentials, and remote-access secrets are non-human identities that directly shape enterprise control. Once those identities are harvested, the attacker is no longer outside the perimeter in any meaningful sense. The implication is that NHI lifecycle, exposure management, and privileged access governance must be evaluated together.

From our research library:

• 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
• Read next: Guide to NHI Rotation Challenges

What this signals

Credential interception changes the response priority: when an attack can harvest VPN, RADIUS, NTLM, and Kerberos material without noisy authentication failures, patching becomes only the first step. The operational follow-on has to be credential invalidation, because the exposure window survives the vulnerability fix.

Identity blast radius is the real Fortinet lesson: a management plane that can collect credentials across 24 protocols turns one exposed control surface into a multi-system trust collapse. That is why administrative scope, network reachability, and protocol handling need to be governed together rather than as separate programmes.

Standing privilege becomes ungovernable once the access path is observable: if a device can passively capture secrets, then ordinary lifecycle controls lose meaning unless the high-risk accounts are re-issued and segmented. 71% of NHIs are not rotated within recommended time frames according to the Ultimate Guide to NHIs, and this campaign shows why rotation discipline matters when trust is already broken.

For practitioners

• Rotate all Fortinet-related credentials immediately Reset VPN, RADIUS, NTLM, Kerberos, and administrative credentials on FortiGate-managed infrastructure, and treat each as potentially observed in transit rather than only stolen from a host.
• Restrict exposure of EMS management access Limit FortiClient EMS port 8013 to trusted IP ranges and review whether any administrative endpoint is reachable from untrusted networks.
• Remove and hunt for unauthorised admin accounts Audit FortiGate administrative accounts for the reported adminin backdoor account and any other unexpected privileged identities.
• Hunt for FortigateSniffer indicators Search for the packet sniffer artefacts, related malicious PowerShell, and the known C2 address 83.138.53.110 and associated Tor exit nodes.
• Enable MFA on administrative interfaces Require multi-factor authentication on FortiGate admin access and verify that remote administration cannot be granted through weaker paths.

Key takeaways

• FortiBleed is best understood as a credential-harvesting campaign against Fortinet trust infrastructure, not as a single-device vulnerability story.
• The article describes access at very large scale, including admin-level control on 409 targets and passive collection across thousands of devices.
• The limiting control is not patching alone, but immediate credential rotation, management-plane restriction, and privileged-account validation.

Key terms

• Credential Harvesting: Credential harvesting is the collection of secrets, tokens, keys, or certificates from a compromised workload. In container environments, it often targets file paths, environment variables, service account tokens, and metadata services because those locations frequently hold reusable identity material.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Management-plane exposure: Management-plane exposure is the risk created when an administrative interface is reachable from the internet or from overly broad internal networks. These surfaces often carry privileged functions, so a flaw there can bypass normal application security assumptions and create immediate control of a critical system.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.