45-GPU cluster cracks Fortinet VPN hashes exposing thousands of networks including Turkish NATO contractor

Hudson Rock researchers recovered a database listing cracked hashes from Fortinet devices across India, the United States, Taiwan, Mexico, Turkey and Thailand. The top affected sectors were IT services, telecommunications, construction and financial services, with named victims including Foxconn, Samsung, Siemens, PwC and Accenture plus multiple government agencies. Lateral movement succeeded because the same weak passwords protected centralized authentication systems.

The cracking pipeline combined custom eight-word dictionaries, keyboard patterns and feedback loops that seeded new candidates from every successful guess. This produced operational access where standard wordlists had failed. Artifacts left on the cracking server revealed poor operational security despite the technical sophistication of the GPU infrastructure.

Fortinet perimeter devices remain high-value targets because they accept external connections and sit directly in front of internal resources. Organizations listed in the database face ongoing risk from any actor who obtained the same plaintext credentials. Immediate steps include rotation of all VPN accounts, enforcement of hardware-token MFA and removal of legacy SSL VPN configurations.

Subsequent incidents will likely involve reuse of these credentials against the same organizations or their downstream suppliers within the next 90 days.