The FortiBleed campaign is one of the more sobering stories of 2026, and it's worth understanding precisely — because the obvious lesson is the wrong one.

Attackers deployed a custom packet-sniffing tool on compromised FortiGate firewalls and intercepted VPN credentials and authentication data directly out of network traffic. Public reporting puts the campaign at more than 430,000 FortiGate firewalls targeted, with sniffers planted on roughly 19,000 devices. Earlier, a server holding credentials stolen from over 73,000 Fortinet devices was found sitting exposed on the open internet.

Then in July, researchers connected the dots: FortiBleed infrastructure was tied to operators working negotiation panels for both the INC and Lynx ransomware groups — linking mass firewall credential theft directly to ransomware deployment. At least a dozen ransomware deployments have already been traced to that access, encrypting hundreds of endpoints.

The instinct is to fix the credential

Rotate everything. Force resets. Turn on MFA. All of that is correct and you should do it.

But notice what FortiBleed actually did: it captured credentials in transit, from the device that was supposed to be protecting the perimeter. The password wasn't guessed, phished, or brute-forced. It was read off the wire by the gatekeeper itself. No password policy in the world defends against that.

Which forces an uncomfortable admission: at scale, credential theft is not preventable. Between infostealers, phishing kits, push-fatigue attacks, session-token theft, and campaigns like this one, you should assume that sooner or later a valid credential for your environment will be in someone else's hands.

So the useful question isn't how do we stop credentials from being stolen. It's what does a stolen credential actually buy an attacker?

With a VPN, it buys your network

That's not a flaw in anyone's VPN — it's the design. A VPN authenticates you and then places you on the network. It doesn't ask what you need. It hands over a broad slice of internal reachability and trusts you to behave.

So a credential harvested off a firewall becomes an authenticated foothold inside a flat network. And what happens next happens fast: current incident data puts average breakout time — initial access to lateral movement — at about 29 minutes, roughly 65% faster than the prior year, with the fastest observed case at 27 seconds.

Sit with that number. Twenty-nine minutes is shorter than most alert triage queues. It is dramatically shorter than a night shift's response window, and 27 seconds is shorter than the time it takes a human to read the alert. You cannot out-respond that with people. If your security model depends on noticing an intruder and reacting before they spread, the math has already beaten you.

With Zero Trust, it buys one application

Change what the credential unlocks and the entire equation collapses.

Under ZTNA, authentication doesn't put anyone on a network — because no network is handed out. Every request is evaluated against identity, device posture, and context, and access is granted to specific applications the identity is entitled to, through a session-scoped microperimeter that's created at connection time and torn down when the session ends.

A stolen credential belonging to an accounts-payable manager grants exactly what that manager could reach: the finance app, and nothing else. No subnet to sweep. No RDP and SMB scanning across the estate. No cached domain-admin credential waiting on a forgotten file server. The lateral movement step — the one that turns a single compromise into a company-wide ransomware event — has nowhere to go.

There's a second-order benefit worth noting given how FortiBleed worked. Our gateways are cloaked with Single Packet Authorization: they don't respond to unauthorized traffic at all, so there's no internet-facing appliance advertising itself as a target for the initial compromise that made the credential harvesting possible in the first place.

And because verification is continuous rather than one-time-at-login, a credential that starts behaving like an attacker — odd hours, machine-timed cadence, reaching for resources it never touches — loses its access mid-session instead of at the next login.

What this doesn't fix

Being straight about it: Zero Trust would not have prevented the credentials from being stolen. If an attacker owns the device in the path, they can capture what crosses it.

What changes is the blast radius. The difference between "an attacker has one user's credential" and "an attacker has your network" is the entire difference between an incident and a catastrophe. That's why we pair ZTNA with SentinelOne on the endpoint — the network layer denies the movement, the endpoint layer kills the payload autonomously if something does execute — and why backups belong behind their own policy boundary rather than reachable from general user access.

The takeaway

FortiBleed will not be the last campaign to harvest credentials at scale. Given the economics — roughly twenty people ran this operation, and it fed at least two ransomware brands — it won't even be the last this year.

Plan for the credential to be stolen. Then make sure it isn't worth much.

Want to know how far a stolen credential would get in your environment? Take the 2-minute Zero Trust readiness quiz, or see what cloaked ZTNA + SentinelOne costs — bundled, and less than buying either alone.

Sources: public reporting on the FortiBleed campaign from BleepingComputer, The Hacker News, SecurityWeek, Dark Reading, and Cybersecurity Dive, July 2026.