Inside the Global FortiGate Access Campaign Report

The FortiGate credential leak is not a one-off exploit but a full credential operation. The actor scanned internet-facing Fortinet FortiGate and SSL VPN devices, combined leaked password lists with weak legacy hash storage, and built a validated dataset enriched with domain, sector, country, and port data, clearly prepared for Initial Access rather than left as a raw dump. 

The impact is global. Victims range from Fortune 500 companies and telecom operators to critical infrastructure and, most seriously, government domains across India, Puerto Rico, the United States, Brazil, and others. The targeting of government systems pushes this beyond ordinary cybercrime into a national-security concern. The focus on mid-tier organizations and exposed management ports such as 443, 9443, 4443, and 8443 shows a deliberate strategy aimed at internet-exposed management surfaces.