The attack targets 320,000 firewall devices using stolen logins, affecting organizations in 194 countries and enabling lateral network access.

A large-scale credential theft campaign known has exposed login data tied to tens of thousands of Fortinet firewalls and VPN systems around the world.

Security researchers report that the operation has impacted organizations across 194 countries, including major global firms such as Samsung and Oracle.

The campaign was first identified by security researcher Volodymyr “Bob” Diachenko, and later analyzed by Hudson Rock. Investigators found that more than 320,000 FortiGate devices had been targeted, through roughly 1.16bn credential-based login attempts, highlighting the massive scale and persistence of the operation.

Hudson Rock’s analysis uncovered 73,932 distinct firewall URLs associated with 21,632 affected domains. Separate validation by SOCRadar confirmed that over 30,000 devices had been compromised. The highest concentrations of impacted systems were observed in countries including India, the United States, Taiwan, and Mexico.

Rather than exploiting new software vulnerabilities, the attackers relied on previously stolen credentials. The group—believed to be a Russian-speaking, multi-operator network—leveraged data harvested from infostealer malware and cracked SSL VPN password hashes using high-powered GPU infrastructure. This allowed them to gain access to exposed systems and move laterally within networks.

In parallel with the Fortinet-focused attacks, the same operators conducted an additional wave of activity targeting MSSQL servers, launching more than 2.1bn brute-force login attempts against over 160,000 systems. The industries most impacted include IT services, construction materials, telecommunications, and even government sectors.

A free lookup tool has been released by Hudson Rock, that allows firms to check whether their domains appear in the leaked data and request responsible disclosure. Security professionals strongly advise organizations to immediately rotate all credentials associated with Fortinet VPNs and administrative interfaces, enforce multi-factor authentication, review access logs for suspicious behavior, and limit management access to trusted internal networks.

Experts emphasize that password complexity alone is not sufficient protection if credentials have already been compromised. This credential theft campaign serves as a stark reminder that even large, well-resourced organizations remain vulnerable when basic credential hygiene and security practices are not consistently maintained.