CRITICAL: FortiBleed Additional Dataset Special Report

LAST UPDATED: 2026-06-26

DEFAULT SEVERITY LEVEL: CRITICAL

This Special Report contains information about compromised devices referenced on the Fortibleed threat actors infrastructure and shared with us by SpyCloud. They wrote about their findings here: https://spycloud.com/blog/what-spycloud-found-inside-the-fortibleed-threat-actor-infrastructure/

This dataset comes in addition to IPs listed in the Fortibleed dataset shared by SOCRadar which was reported out in our Compromised Website report on 2026-06-18. The exception is a part of the dataset where the attackers ran credential sniffing via SSH on the compromised devices. The Special Report dated 2026-06-26 contains data collected at 2026-06-17. The full extent of the time period for all events is unclear.

Shadowserver Special Reports are unlike all of our other standard free daily network reports. They do not cover a specific daily 24-hour time period. Instead, we send out Special Reports in situations where we are able to share one-time, high value datasets that we feel should be reported responsibly for maximum public benefit. Sometimes there are incidents when it would be useful to be able to notify potential victims about events or breaches that may have impacted them outside of the previous 24-hour period, when it may take a number of days for incident responders to conduct forensic investigations and analyzed data becomes available for sharing with potential victims. Although the events included in these Special Reports will fall outside of our usual 24-hour daily reporting window, we believe that there would still be significant benefit to our constituents in receiving and, hopefully, acting on the retrospective data.

If you have missed a Special Report because you were NOT yet a subscriber at the time a report was pushed out, simply subscribe for your network now and specifically request all recent Shadowserver Special Reports – and we will regenerate them specifically for your network, at no cost.

Note that the data shared across Special Reports may differ on a case by case basis, hence the report formats for individual Special Reports may be different.

Note that exact timestamps were not available for individual events, so the timestamp field is set to “2026-06-26 00:00:00”.

This Special Report has severity level CRITICAL set on all events. Severity levels are described here.

Filename prefix: 2026-06-26-special. Note: these are accessible in the API using 2026-06-26 as the search date.

Fields

  • timestamp
    The timestamp has been set to "2026-06-26 00:00:00", to represent when this one-off data set was distributed.
  • ip
    IP address of the affected device
  • port
    TCP or UDP port identified
  • protocol
    Protocol associated with the malicious activity
  • asn
    Autonomous System Number of the affected device
  • geo
    Country of the affected device
  • region
    Region of the affected device
  • city
    City of the affected device
  • hostname
    Hostname of the affected device (may be from reverse DNS)
  • naics
    North American Industry Classification System Code
  • sector
    Sector of the IP in question
  • tag
    Additional tags for more insight
  • infection
    Description of the malware/infection (unused)
  • public_source
    Source of the data
  • status
    Status of the affected IP, for example, "compromised"
  • detail
    URL to obtain more detail
  • account
    Account compromised (unused)
  • method
    Request method (unused)
  • device_vendor
    Vendor of the targeted device
  • device_type
    Type of the targeted device
  • device_model
    Model of the targeted device
  • device_version
    Version of the targeted device
  • severity
    Severity level
  • hostname_source
    Hostname source
  • first_seen_time
    When certain activity was first observed; used to identify when credential sniffing started
  • last_seen_time
    When activity was last seen (unused)
  • potential_exposure_time
    Potential exposure time - difference between first_seen_time and last_seen_time (unused)
  • machine_name
    Name of the compromised machine
  • url
    URL if any (unused)
  • login
    Account login that was compromised
  • password
    (Redacted) Password that was compromised

Sample

"timestamp","ip","port","protocol","asn","geo","region","city","hostname","naics","sector","tag","infection","public_source","status","detail","account","method","device_vendor","device_type","device_model","device_version","severity","hostname_source","first_seen_time","last_seen_time","potential_exposure_time","machine_name","url","login","password"
"2026-06-26 00:00:00",192.168.0.1,8443,tcp,64512,ZZ,Region,City,node01.example.com,0,,fortibleed,,spycloud,compromised,https://spycloud.com/blog/what-spycloud-found-inside-the-fortibleed-threat-actor-infrastructure/,,,Fortinet,firewall,FortiGate,,critical,ptr,,,,node01,,admin,******23
"2026-06-26 00:00:00",192.168.0.2,443,tcp,64512,ZZ,Region,City,node02.example.com,0,,fortibleed,,spycloud,compromised,https://spycloud.com/blog/what-spycloud-found-inside-the-fortibleed-threat-actor-infrastructure/,,,Fortinet,device-management,"FortiGate Management Interface",,critical,ptr,,,,node02,,Administrator,******23
"2026-06-26 00:00:00",192.168.0.3,443,tcp,64512,ZZ,Region,City,node03.example.com,0,,fortibleed,,spycloud,compromised,https://spycloud.com/blog/what-spycloud-found-inside-the-fortibleed-threat-actor-infrastructure/,,,,,,,critical,ptr,,,,node03,,admin,******56

Our 145 Report Types

« Back to Network Reporting