{
  "Event": {
    "analysis": "1",
    "date": "2026-06-19",
    "extends_uuid": "",
    "info": "[Threat Intel] Inside the FortiBleed Open Directory: A Technical Analysis of What the Attacker Left Behind",
    "protected": false,
    "publish_timestamp": "1782443599",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782443599",
    "uuid": "eaf1b007-6006-46b3-876c-77d30fff9633",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#7bf409",
        "local": false,
        "name": "misp-galaxy:producer=\"CloudSEK\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Password Guessing - T1110.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7773ac",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"",
        "relationship_type": ""
      },
      {
        "colour": "#8efd0f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Security Account Manager - T1003.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domain Account - T1087.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domain Groups - T1069.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#aad818",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#041edc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SMB/Windows Admin Shares - T1021.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Vulnerability Scanning - T1595.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#6ef296",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Password Spraying - T1110.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#06e9fb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Addresses - T1589.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#cac736",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Employee Names - T1589.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#70b0b5",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Brute Force - T1110\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#267ff2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials - T1589.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#3970d7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"",
        "relationship_type": ""
      },
      {
        "colour": "#50bd28",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"",
        "relationship_type": ""
      },
      {
        "colour": "#f9fe8d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Kerberoasting - T1558.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#b8ab01",
        "local": false,
        "name": "misp-galaxy:target-information=\"United States\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Colombia\"",
        "relationship_type": ""
      },
      {
        "colour": "#013748",
        "local": false,
        "name": "misp-galaxy:target-information=\"India\"",
        "relationship_type": ""
      },
      {
        "colour": "#d52b43",
        "local": false,
        "name": "misp-galaxy:target-information=\"Mexico\"",
        "relationship_type": ""
      },
      {
        "colour": "#2613b0",
        "local": false,
        "name": "misp-galaxy:target-information=\"Taiwan\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"data-breach\"",
        "relationship_type": ""
      },
      {
        "colour": "#120046",
        "local": false,
        "name": "rectifyq:sub-category=\"infra-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782126007",
        "to_ids": false,
        "type": "link",
        "uuid": "8e82dfbe-80a5-4201-a964-2cc0292f2db6",
        "value": "https://www.cloudsek.com/blog/inside-the-fortibleed-open-directory-a-technical-analysis-of-what-the-attacker-left-behind"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782126007",
        "to_ids": false,
        "type": "text",
        "uuid": "41dbe6c9-5b83-4970-bd1d-281075c425e1",
        "value": "An exposed attacker server has unveiled FortiBleed, a large-scale credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways globally. This operation involved credential harvesting through reuse, brute force, and hash cracking using a distributed GPU infrastructure with approximately 36 rented GPUs via Hashtopolis. The exposed directory contained 319 files revealing scanning tools, cracking infrastructure, credential databases, post-exploitation toolkits, and active VPN configurations. While initially reported as affecting 21,632 domains, analysis of the attacker's own tooling reveals only 918 organizations showed evidence of internal network compromise, with merely 148 confirmed cases where credentials were fully cracked. The operation ultimately aimed to sell initial access to compromised networks, with victims spanning 194 countries, predominantly India, United States, and Taiwan."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782126007",
        "to_ids": false,
        "type": "text",
        "uuid": "d693b5cd-aacf-4d05-a193-1aa7665c30ad",
        "value": "Name: Inside the FortiBleed Open Directory: A Technical Analysis of What the Attacker Left Behind\nAuthor: AlienVault\nAdversary: \nTags: [\"vpn compromise\", \"hash cracking\", \"fortibleed\", \"hashtopolis\", \"fortigate\", \"initial access broker\", \"fortinet\", \"credential harvesting\"]\nTgtd countries: [\"United States of America\", \"British Indian Ocean Territory\", \"Colombia\", \"India\", \"Mexico\", \"Taiwan\"]\nMlwr families: []\nAttack_ids: [\"T1110.001\", \"T1133\", \"T1003.002\", \"T1087.002\", \"T1069.002\", \"T1021.004\", \"T1135\", \"T1190\", \"T1021.002\", \"T1595.002\", \"T1110.003\", \"T1589.002\", \"T1589.003\", \"T1552.001\", \"T1110\", \"T1078\", \"T1589.001\", \"T1018\", \"T1046\", \"T1558.003\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442687",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2e7f0638-7420-4c4f-9fc8-5feb5de44d30",
        "value": "85.11.187.8",
        "Tag": [
          {
            "colour": "#23d92f",
            "local": false,
            "name": "asn:asn=\"25369\"",
            "relationship_type": ""
          },
          {
            "colour": "#0e9e0b",
            "local": false,
            "name": "asn:as-owner=\"BANDWIDTH-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442708",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a54aa72b-e74e-4466-9519-6cd3103ce683",
        "value": "175.155.64.221",
        "Tag": [
          {
            "colour": "#fcc130",
            "local": false,
            "name": "asn:asn=\"4837\"",
            "relationship_type": ""
          },
          {
            "colour": "#a33581",
            "local": false,
            "name": "asn:as-owner=\"CHINA169-BACKBONE CHINA UNICOM China169 Backbone\"",
            "relationship_type": ""
          },
          {
            "colour": "#9256df",
            "local": false,
            "name": "asn:as-country=\"CN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"china\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442729",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "7f35b68c-ac1d-4157-9f49-7a17e7deb613",
        "value": "185.229.26.83",
        "Tag": [
          {
            "colour": "#8e45d0",
            "local": false,
            "name": "asn:asn=\"200899\"",
            "relationship_type": ""
          },
          {
            "colour": "#d34c03",
            "local": false,
            "name": "asn:as-owner=\"INTERSPACE-EUROPE\"",
            "relationship_type": ""
          },
          {
            "colour": "#02456b",
            "local": false,
            "name": "asn:as-country=\"MK\"",
            "relationship_type": ""
          },
          {
            "colour": "#c16c6e",
            "local": false,
            "name": "misp-galaxy:country=\"north macedonia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442751",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6e751b3f-57f0-412f-89f0-e7c23adb969d",
        "value": "198.53.64.194",
        "Tag": [
          {
            "colour": "#0403b0",
            "local": false,
            "name": "asn:asn=\"852\"",
            "relationship_type": ""
          },
          {
            "colour": "#1e2931",
            "local": false,
            "name": "asn:as-owner=\"TELUS Communications\"",
            "relationship_type": ""
          },
          {
            "colour": "#1273fb",
            "local": false,
            "name": "asn:as-country=\"CA\"",
            "relationship_type": ""
          },
          {
            "colour": "#813aa0",
            "local": false,
            "name": "misp-galaxy:country=\"canada\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442771",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "918ae963-b0a4-442d-bb72-68553b7fbbb2",
        "value": "213.169.49.142",
        "Tag": [
          {
            "colour": "#a600dd",
            "local": false,
            "name": "asn:asn=\"8717\"",
            "relationship_type": ""
          },
          {
            "colour": "#cdadfa",
            "local": false,
            "name": "asn:as-owner=\"A1\"",
            "relationship_type": ""
          },
          {
            "colour": "#059db5",
            "local": false,
            "name": "asn:as-country=\"BG\"",
            "relationship_type": ""
          },
          {
            "colour": "#390b5f",
            "local": false,
            "name": "misp-galaxy:country=\"bulgaria\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442793",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "ce0d1fcc-e405-497e-a1ca-2cd14be4e507",
        "value": "38.117.87.37",
        "Tag": [
          {
            "colour": "#a1dae3",
            "local": false,
            "name": "asn:asn=\"208962\"",
            "relationship_type": ""
          },
          {
            "colour": "#2ce6bb",
            "local": false,
            "name": "asn:as-owner=\"NEXTREMUM\"",
            "relationship_type": ""
          },
          {
            "colour": "#58e5c7",
            "local": false,
            "name": "asn:as-country=\"CZ\"",
            "relationship_type": ""
          },
          {
            "colour": "#52def7",
            "local": false,
            "name": "misp-galaxy:country=\"czechia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442814",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "564af021-2168-429f-adf7-17f31927221e",
        "value": "85.11.187.28",
        "Tag": [
          {
            "colour": "#23d92f",
            "local": false,
            "name": "asn:asn=\"25369\"",
            "relationship_type": ""
          },
          {
            "colour": "#0e9e0b",
            "local": false,
            "name": "asn:as-owner=\"BANDWIDTH-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442838",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a5a7ee86-ed0b-410e-b6d1-fdfe62601add",
        "value": "193.8.187.2",
        "Tag": [
          {
            "colour": "#d60031",
            "local": false,
            "name": "asn:asn=\"214238\"",
            "relationship_type": ""
          },
          {
            "colour": "#34645c",
            "local": false,
            "name": "asn:as-owner=\"IWIHOST\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}