FortiBleed Leak Exposes FortiOS SSL-VPN Credentials of Multiple Organizations
FortiOS SSL-VPN credentials were exposed in the FortiBleed 2.0 leak, affecting several organizations. The leak's exploitation has been reported.
OffSet7 Newsroom · Reviewed by an OffSet7 analyst · AI-assisted
What happened
FortiOS SSL-VPN credentials were exposed in the FortiBleed 2.0 leak.
Who is affected
Revi Group, Societe Ivoirienne De Telediffusion, www.zhservices.com, www.choicegoodwill.com, Zhito Technology.
Exploited
The FortiOS SSL-VPN credentials were exposed.
What to do
No specific guidance published yet.
The FortiBleed 2.0 leak, which occurred in October 2026, has led to the exposure of FortiOS SSL-VPN credentials. This incident has reportedly affected several organizations, including Revi Group, Societe Ivoirienne De Telediffusion, www.zhservices.com, www.choicegoodwill.com, and Zhito Technology.
The groups Qilin, Krybit, and Dragonforce have claimed responsibility for publishing information about these victims. Qilin is associated with the exposure of Revi Group and Societe Ivoirienne De Telediffusion, while Krybit has published details about www.zhservices.com and www.choicegoodwill.com. Dragonforce has claimed responsibility for Zhito Technology.
The exposure of credentials is linked to the FortiBleed leak, specifically identified as CVE-2022-40684. The leak has been confirmed to have resulted in the exposure of sensitive information, raising concerns about the security of affected systems.
No specific guidance has been published yet regarding mitigation or response actions for this incident. Organizations using FortiOS are advised to remain vigilant and monitor for any updates from Fortinet.
