A financially motivated Russian-speaking initial access broker (IAB) is behind ‘FortiBleed,’ a large-scale credential-harvesting operation. The campaign, active since February 2026, targeted over 430,000 FortiGate firewalls globally. Attackers collected credential lists, searched for exposed services, brute-forced systems, and deployed custom malware, resulting in the compromise of 110 million credentials.