FortiBleed Campaign: Reverse Engineering the CyberStrike Harvester Behind Global FortiGate Credential Theft

Summary

FortiBleed is a large-scale credential compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. Unlike typical malware-based attacks, it uses a credential pipeline combining credential stuffing, password spraying, configuration harvesting, offline cracking, and post-authentication capture processing. Arctic Wolf researchers reverse-engineered a recovered CyberStrike Harvester binary and connected it to the broader FortiBleed operator workflow, demonstrating how exposed perimeter credentials can escalate into full internal-network compromise.

Source

bskyFortiBleed Campaign: Reverse Engineering the CyberStrike Harvester Behind Global FortiGate Credential Theftarcticwolf.com