FortiBleed 2.0: 75% of Breached Organizations Are Brand-New (Free Lookup Tool Available)

Following Hudson Rock’s landmark FortiBleed investigation, a massive second wave of 1,703 parsed FortiGate configurations extracted by threat actor “k0t” reveals what happens after initial firewall access: 36,964 cleartext SSL-VPN users, 1,937 decrypted Active Directory LDAP bind accounts, and conclusive forensic proof that 89.3% of “remediated” repeat victims left rogue super-admin backdoors wide open.

• 01 Executive Summary & NyxLab Credit
• 02 Anatomy of the “k0t” Pipeline
• 03 FortiBleed 1.0 vs. 2.0 Comparison
• 04 The 89.3% Persistence Smoking Gun
• 05 Unmasking 54.8% of Hidden Victims
• 06 Internal Network Recon Blueprints
• 07 Mandatory Remediation Playbook

Immediate Exposure Verification & Cavalier Integration

All 101,419 credential records, 1,248 verified corporate domains, and 1,689 compromised FortiGate IP addresses analyzed in this research have been indexed into Hudson Rock’s Cavalier cybercrime intelligence platform and integrated into our free community verification portal. Organizations can immediately query their domains to determine if their perimeter appliances, VPN users, or Active Directory bind accounts were exposed.

Furthermore, the raw FortiBleed 2.0 dataset, along with the original FortiBleed 1.0 dataset and the LiteLLM breach data, are already available for direct download to Hudson Rock’s Data Enrichment customers through our platform Cavalier under the new Breach Data hub.

What impacted organizations receive in their ethical disclosure:

• Exact Appliance IP & Hostname: Direct mapping to your perimeter devices.
• Compromised Usernames & Hashes: Affected System Admin accounts, rogue backdoor logins (fgtsecure, etc.), and decrypted local VPN users.
• Active Directory LDAP Bind Account Exposure: The specific service account name and cleartext password dumped from your firewall.
• Internal Network Topology Artifacts: Specific internal subnets, Domain Controllers, and backup systems identified in the configuration file.

For Hudson Rock Data Enrichment Customers: The full raw FortiBleed 2.0 dataset, alongside the original FortiBleed 1.0 dataset and the LiteLLM breach archive, are already live and available for direct access and download inside Hudson Rock’s Cavalier platform under the Breach Data menu.

Check Your Organization at hudsonrock.com/fortinet → Explore Data in Hudson Rock Cavalier

1. Executive Summary & Research Attribution

Earlier in 2026, Hudson Rock uncovered the original “FortiBleed” leak, an unprecedented exposure of nearly 75,000 compromised Fortinet FortiGate firewall records (73,931 verified super_admin login pairs across 69,055 unique hosts) linked to the critical zero-day authentication bypass vulnerability CVE-2026-24858 (CVSS 9.4) in FortiOS, FortiProxy, and FortiSwitchManager. That initial disclosure showed how threat actors weaponized malicious FortiCloud SSO accounts to mass-harvest administrative credentials and create rogue management accounts across global enterprise perimeters.

Today, Hudson Rock researchers are releasing a deep-dive forensic analysis into FortiBleed 2.0: a massive post-exploitation dataset consisting of 1,703 fully parsed FortiGate configuration dumps (representing 1,689 unique firewall IP addresses and 101,419 extracted credential records).

While FortiBleed 1.0 was a perimeter verification list confirming that an attacker held a working super_admin login and scraping surface metadata (FortiGuard ID, SNMP Contact, and DNS Domain), the FortiBleed 2.0 dataset exposes the complete internal anatomy of every breached appliance. Using custom Python automation, the threat actor known as “k0t” (affiliated with the 1011.team syndicate and acting as a supplier to the Qilin and The Gentlemen ransomware operations) logged into each compromised FortiGate, downloaded its raw configuration backup, and systematically reversed FortiOS’s symmetric password encryption.

2. Anatomy of the “k0t” Post-Exploitation Pipeline

Forensic artifacts inside the leaked configuration dumps show how k0t industrialized the transition from FortiGate Perimeter Access to Full Active Directory Domain Compromise. Rather than manually inspecting firewalls, the actor built a multi-stage automation pipeline:

1. Automated Config Extraction & Cryptographic Reversal (forti_parse.py): While FortiOS hashes System Admin passwords using SHA-256 (SH2) or PBKDF2 (PB2), it stores SSL-VPN Local User passwords, Active Directory LDAP bind passwords, HA Cluster keys, and SMTP relay credentials using reversible symmetric encryption (ENC …) derived from a static key compiled into the FortiOS binary. k0t’s parser automatically decrypted 40,573 cleartext passwords across the 1,703 appliances.
2. Automated SSL-VPN Tunneling (vpn_checker.py / OpenConnect): Using the decrypted Local Users table and the verified super_admin credentials, the actor spun up headless openconnect SSL-VPN sessions into the victim’s internal corporate LAN.
3. Active Directory Harvest via NetExec (nxc): Once inside the VPN tunnel, the toolchain immediately targeted the exact internal Domain Controller IP addresses listed in the firewall’s LDAP configuration table.
   
   Critical Anti-Pattern Discovered: Many IT administrators configured actual Domain Admin or highly privileged service accounts as the LDAP bind user to save time during setup. When k0t decrypted these bind credentials, they instantly obtained full Active Directory domain query rights to dump NTDS.dit and deploy ransomware.

3. Head-to-Head Comparison: FortiBleed 1.0 vs. FortiBleed 2.0

A critical question for defenders and CISOs is whether the FortiBleed 2.0 dataset is simply a subset of the original FortiBleed 1.0 leak previously reported by Hudson Rock, or whether it represents net-new compromises.

Hudson Rock researchers performed a programmatic cross-correlation between all 73,931 credential lines (spanning 69,055 unique hosts and 22,029 domains) in FortiBleed 1.0 and all 101,419 credential records (spanning 1,689 unique IPs and 1,248 verified corporate domains using strict identity fields) in FortiBleed 2.0. The findings prove that over half of the compromised firewalls (54.7%) and three-quarters of the identified victim organizations (75.5%) are completely net-new.

4. The Persistence Smoking Gun: What Happened on the 765 Overlapping Firewalls?

While the 924 net-new firewalls demonstrate the expanding reach of FortiGate exploitation, the 765 firewall IP addresses that appeared in both FortiBleed 1.0 and FortiBleed 2.0 provide an extraordinary forensic window into how enterprises failed to remediate CVE-2026-24858, and how multiple threat actors stacked rogue backdoors on the exact same appliances.

Why Did the Admin Account Change on 242 Firewalls?

In FortiBleed 1.0, those 242 firewalls were primarily accessed via default or first-wave rogue accounts such as admin (66x), Technical_support (22x), laboratorio (16x), forti-auth-tech (11x), and martinwong (7x). In FortiBleed 2.0, the actor authenticated to those exact same appliances using secondary rogue backdoor accounts, most notably:

• fgtsecure (106 overlapping appliances, typically paired with a standardized attacker password)
• admin (25 overlapping appliances where the previous leak used a different admin account)
• Technical_support (22 overlapping appliances)
• callcenter / Callcenter (17 overlapping appliances)
• fgtsec (11 overlapping appliances) & forticloud-sync (5 overlapping appliances)

5. The “Unmasking” Effect: How Deep Config Parsing Reveals 54.8% of Victims Hidden Behind MSSPs & Freemail

One of the most significant breakthroughs in analyzing FortiBleed 2.0 is resolving a major blind spot from FortiBleed 1.0. In the first leak, victim attribution relied almost entirely on the appliance’s registered FortiGuard ID email address.

In practice, thousands of enterprise FortiGate appliances are deployed and licensed by Managed Security Service Providers (MSSPs), regional telecommunications carriers, third-party IT integrators, or local administrators using personal freemail accounts or leaving the registration set to NONE. As a result, thousands of breached organizations in the first leak were misattributed to their telecom provider or hidden under generic freemail buckets.

By building a multi-layered attribution engine that inspects the internal Active Directory LDAP Distinguished Name (DC=corp,DC=com), SSL-VPN Local User email addresses, and System DNS Domains before falling back to the FortiGuard ID, Hudson Rock researchers discovered that among the 765 overlapping firewalls, deep config parsing unmasked a completely different true victim organization on 419 appliances (54.8%).

6. Beyond Credentials: Turnkey Internal Network Blueprints for Ransomware Affiliates

Even when an organization enforces Multi-Factor Authentication (MFA) on standard employee SSL-VPN accounts (though our telemetry shows that over 98% of the 83,414 extracted Local User profiles had Two-factor: disable), the leaked configuration files hand ransomware operators a complete blueprint of the internal network via the ### Policy & Objects -> Addresses ### and ### Static Routes ### tables.

Before initiating a single network scan that might trigger an Endpoint Detection and Response (EDR) alert, ransomware affiliates using k0t’s dumps already know the exact internal IPv4 addresses, subnets, and VLAN interfaces of the victim’s crown-jewel infrastructure:

• Backup & Disaster Recovery Servers: Explicit firewall address objects naming Veeam_Backup, NAS_Synology, Qnap_Backup, and Rubrik_Cluster alongside their exact internal IP addresses.
• Virtualization & Hypervisor Management: Direct mappings to vCenter_Server, ESXi_Host_01, NutaniX_CVM, and Proxmox management interfaces.
• Identity & Core Enterprise Infrastructure: Internal IP addresses for primary and secondary Active Directory Domain Controllers (DC01, DC02), Microsoft Exchange servers, SAP ERP databases, and internal jumpboxes.

7. Mandatory Remediation Playbook: Why Resetting Your Admin Password Is Not Enough

Our forensic comparison between FortiBleed 1.0 and FortiBleed 2.0 proves that simply patching FortiOS or rotating the primary admin password leaves organizations completely exposed to re-compromise. Security teams must execute a comprehensive four-tier eradication workflow:

Verify Your Exposure in Hudson Rock Cavalier & Our Free Fortinet Portal

To assist defenders, CERTs, and enterprise SOC teams globally, Hudson Rock has integrated the entirety of the 101,419 credential records and 1,248 verified corporate domains from FortiBleed 2.0, alongside the original FortiBleed 1.0 dataset, into Hudson Rock’s Cavalier platform and our free public lookup utility. Furthermore, the raw FortiBleed 2.0, FortiBleed 1.0, and LiteLLM datasets are already available for direct download to Hudson Rock’s Data Enrichment customers inside Cavalier.

Search Your Domain Free at www.hudsonrock.com/fortinet → Read Our Original FortiBleed Investigation