The FBI is warning that FortiBleed attacks are still ongoing, targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways and locking out legitimate administrators.

[Wayback/Archive] Hashtopolis HashtopolisHashtopolis is a distributed password recovery tool working with hashcat Via: [Wayback/Archive] security.nl on Twitter: "NFI onderhoudt opensourcesoftware voor kraken wachtwoorden smartphones #securitynl" [Wayback/Archive] NFI onderhoudt opensourcesoftware voor kraken wachtwoorden smartphones - Security.NL --jeroen

FortiBleed exposed 75,000 compromised Fortinet firewalls and showed how attackers rented Vast.ai GPU clusters to crack passwords at industrial scale using Hashtopolis and Telegram-managed infrastructure. The campaign highlights how compromised edge devices, infostealer logs, and cracked credentials can enable lateral movement into vendors, MSPs, and internal networks. #FortiBleed #Fortinet #VastAI #Hashtopolis #Cursor #Telegram #SantaAd #Infostealer

CloudSEK tracked FortiBleed, a large credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, and found that its headline numbers were inflated by registration data, internal realm names, and non-Fortinet devices rather than verified company breaches. The exposed attacker directory revealed Hashtopolis-based cracking infrastructure, reused passwords, post-exploitation Active Directory tooling, and a revenue-sorted access-selling pipeline, with only a small fraction of the attributed entries confirming real internal compromise. #FortiBleed #FortiGate #Hashtopolis #FortiOS #Kerberos

Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracked hashes of a Hashtopolis server instance.