# PROFILE: FortiBleed — The Russian Group That Compromised 270 Belgian Organizations Without Them Knowing

> On June 23, 2026, Belgian cybersecurity firm Secutec published an alert that shook Belgium's institutional and professional world: a cybercriminal group linked to Russia had compromised at least 270 organizations across Belgium. Local governments, law firms, schools, businesses — their systems had been infiltrated since February 2026. For months, the attackers had moved freely

- Author: Maxime Marquette
- Publisher: MadMax (https://mad-max.co)
- Section: Profile
- Published: 2026-06-29
- Canonical URL: https://mad-max.co/en/article/portrait-fortibleed-le-groupe-russe-qui-a-compromis-270-organisations-belges-san

## Introduction: A silent Russian cyberattack at the heart of Belgium

### The Secutec alert of June 23, 2026 — when silence becomes an open wound

On **June 23, 2026**, Belgian cybersecurity firm **Secutec** published an alert that shook Belgium's institutional and professional world: a **cybercriminal group linked to Russia** had compromised at least **270 organizations across Belgium**. Local governments, **law firms**, schools, businesses — their systems had been infiltrated since **February 2026**. For months, the attackers had moved freely through their networks without anyone noticing.

The operation, designated under the codename **FortiBleed** in security analyses, exploited a **vulnerability in Fortinet's partner portal** — one of the world's most widely deployed **firewall** manufacturers. By accessing this portal, the Russian hackers were able to steal **more than 110 million credentials** and compromise **75,000 firewalls** worldwide. Belgium was just one of many victims. But its institutional exposure — and the presence of numerous organizations linked to **NATO and the EU** on its soil — made it a particularly attractive target.

### Not a spectacular attack — a patient, methodical infiltration

What characterizes the **FortiBleed** operation is not its brutality but its **patience**. This is not an attack that destroys and announces itself. It is a silent, methodical infiltration designed to **persist as long as possible inside targeted systems**. In at least **45 systems** among the Belgian victims, the hackers created **new user accounts** to ensure persistent access — even if the initial vulnerability was subsequently patched.

This modus operandi is characteristic of actors linked to **Russian intelligence services**: the objective is not always to destroy or paralyze — it is to **collect, monitor, position**. Read communications. Map networks. Identify sensitive personnel. Prepare future operations. This is a **war of intelligence**, not a war of sabotage. And that is precisely why it is so difficult to detect and so dangerous to underestimate.

*270 Belgian organizations compromised for months without anyone knowing. I think about all the lawyers, civil servants, school principals who kept sending their emails, storing their data, managing their files — believing their systems were secure. Ignorance in cyberwar is not protection. It is a vulnerability.*

## Portrait of the attack: how FortiBleed operated

### The Fortinet vulnerability — exploiting the weakest link in the chain

The **vulnerability exploited** by FortiBleed targeted not the Fortinet firewalls themselves, but the company's **partner portal** — the online platform that resellers and commercial partners use to manage licenses, configurations, and technical support. By compromising this portal, the hackers gained access to a **trove of information** about Fortinet installations worldwide: access credentials, **network configurations**, and administrator contact information.

This is a classic **supply chain attack** approach — targeting not the final victim directly, but a trusted intermediary that provides access to it. This method was popularized by the **SolarWinds** attack of 2020, considered one of the most devastating intrusions in cybersecurity history. FortiBleed follows the same blueprint: **compromise the software supply chain** to reach thousands of targets simultaneously through a single initial attack vector.

### 110 million credentials, 75,000 firewalls — the global scale of the operation

FortiBleed's scale extends far beyond Belgium. The numbers are staggering: **110 million credentials stolen** and **75,000 firewalls compromised** worldwide. These firewalls protect the networks of corporations, government institutions, hospitals, universities, and military organizations. Each compromised firewall represents a **potential entry point** into the very network it is supposed to protect.

For Secutec and the cybersecurity experts who analyzed the operation, the purpose of this mass of data is not immediately clear — but several hypotheses impose themselves: **global mapping of targeted organizations**, identification of priority targets for future operations, access to sensitive communications for intelligence operations, or the establishment of **backdoors** activatable at a strategic moment of Moscow's choosing.

*75,000 firewalls compromised worldwide. Each one protects a network. Each of those networks contains sensitive data, private communications, strategic plans. It's as if someone had copied the keys to 75,000 buildings. They haven't entered all of them yet. But they can. Whenever they want. And that is a threat whose magnitude I don't think the public truly grasps.*

## Belgium as a privileged target — why Brussels interests Moscow

### The headquarters of NATO, the EU, and hundreds of international organizations

**Belgium** is not a random target in the Russian cyberespionage arsenal. It is home to **NATO's headquarters**, the **European Union's headquarters**, hundreds of diplomatic missions, defense think tanks, international security agencies, and dozens of companies working on sensitive contracts with these organizations. Infiltrating Belgian networks means potentially accessing information about **strategic decisions of the Atlantic Alliance** and European institutions.

This institutional proximity has made Belgium a prime hunting ground for **Russian intelligence services** for decades. Long before cyberwar, Russian agents were active in Brussels collecting intelligence on NATO and the EU. The shift to cyber did not change the objective — it changed the **tools, the scale, and the speed**. FortiBleed is simply the 2026 version of an intelligence strategy as old as the **Cold War**.

### The 270 Belgian victims: municipalities, lawyers, schools

Among the **270 Belgian organizations** identified as compromised, the diversity of targets is itself revealing. Among them are **local governments** — cities, municipalities, regional administrations — that manage citizens' personal data, urban infrastructure, and crisis plans. There are **law firms**, some of which work on sensitive cases linked to disputes with Russian actors or matters touching on strategic interests. And there are **educational institutions**, which serve as access vectors into broader networks.

For cybersecurity experts, this diversity of targets is not contradictory — it is **strategically coherent**. Organizations with low cyber-defense capacity (municipalities, schools) are often used as **pivot points** to reach better-protected organizations with which they communicate. A compromised municipality can be the starting point for an attack on a **regional security agency**. A compromised law firm can expose the confidential communications of a client working for NATO.

*A law firm is a vault of secrets. A school is a gateway to hundreds of families and their data. A municipality is a hub into an entire local administration. Russian hackers don't only go after NATO's servers — they look for the weakest entry points into the networks that touch, directly or indirectly, what they truly want. That is an intelligence of systemic weakness that the West still underestimates.*

## The modus operandi of Russian hackers — patience, persistence, depth

### Creating persistent accounts — a survival technique inside compromised systems

In at least **45 of the compromised Belgian systems**, FortiBleed's hackers did not only exfiltrate data — they created new **user accounts**, securing permanent network access independent of the initial vulnerability that had opened the door. This technique — known as **persistence establishment** — is one of the hallmarks of **advanced persistent threat (APT) actors** linked to nation-states.

Its principle is simple but formidable: once inside the system, the actor builds an access infrastructure that will survive security patches, password resets, and even software updates. The created account looks like a **legitimate account**. It can pass unnoticed in routine audits. And it guarantees the attacker permanent access — for months, even years — until a **deep forensic investigation** detects it.

### Since February 2026: months of invisible presence inside Belgian networks

One of the most troubling aspects of the Secutec alert is its **temporal dimension**. The infiltration of Belgian organizations reportedly began in **February 2026**. The alert was not published until **June 2026**. Four months of invisible presence, during which the Russian hackers could read, copy, map, and position themselves freely inside the compromised systems. Four months of collected intelligence. Four months of **preparation for potential future operations**.

This gap between intrusion and detection is unfortunately common in the cybersecurity world. Industry studies indicate that the **mean time to detect** an advanced intrusion is 200 days or more. This means that for every attack detected within weeks, there are dozens that persist for six months, a year, sometimes longer. FortiBleed in Belgium is not an exception. It is the **invisible norm** of contemporary cyberwar.

*Four months of invisible presence in Belgian systems. And the alert came from a private firm, not the state. This is not a criticism of the Belgian state specifically — it is a reality common to almost every Western country. Our capabilities for detecting and responding to advanced cyber threats are not commensurate with the ambition of the attackers. And that asymmetry is a systemic problem that neither speeches nor conferences will fix.*

## The group behind FortiBleed — actors linked to Russian intelligence

### The hallmarks of a Russian state APT

Attributing a cyberattack is always complex and rarely absolute. But the FortiBleed operation presents several **characteristic markers** of **APT (Advanced Persistent Threat) groups** linked to Russian intelligence services: the technical sophistication of the attack vector, the strategic selection of targets (heavy concentration on NATO member states), the persistence technique of account creation, and the apparent objective of **long-term intelligence collection** rather than immediate sabotage.

These characteristics match the profiles of well-documented Russian groups such as **APT29 (Cozy Bear)** and **Sandworm**, affiliated respectively with the **SVR** (Foreign Intelligence Service) and the **GRU** (military intelligence). These groups have a long history of operations against Western targets: the compromise of the **US Democratic National Committee** in 2016, the attacks against **Ukrainian infrastructure** in 2017, the **SolarWinds** affair in 2020, and many more.

### The link with the war in Ukraine — the cyber campaign as a parallel front

FortiBleed did not happen in a vacuum. It is part of a **systematic Russian cyber campaign** directed against countries supporting Ukraine. Belgium, as NATO's host nation and an active EU member backing Kyiv, is a **natural target** in that strategy. Intelligence collected on Belgian networks can feed Russian strategic decision-making on the Ukraine war — providing information on allied positions, **planned weapons deliveries**, and ongoing diplomatic discussions.

More broadly, Russia's cyber campaign against the West is the **third front** of the war in Ukraine — after the military front and the economic sanctions front. Russia, aware of its limitations on the first two fronts, is investing massively in cyberwar to compensate: **destabilizing allied institutions**, collecting intelligence, preparing sabotage options for potential future escalations, and maintaining **permanent psychological pressure** on Western governments and populations.

*Russia's cyberwar against NATO is inseparable from the war in Ukraine. It's the same conflict, fought with different weapons. And while we talk about missiles and sanctions, this invisible war is unfolding inside our own servers, our own networks, our own town halls and law offices. I'm not saying this to provoke fear. I'm saying it to demand that our governments take this front seriously.*

## Belgium's response and its allies — adequate, insufficient, or both?

### Secutec, the alert, and emergency measures

Secutec's alert on **June 23, 2026** triggered an emergency response across affected organizations. Security teams were mobilized to audit accesses, close suspicious accounts, apply available patches, and strengthen monitoring of compromised networks. The **Centre for Cybersecurity Belgium (CCB)** was involved in coordinating the national response.

But an emergency response, however professional, cannot erase **months of hacker presence** inside compromised systems. Data that may have been exfiltrated cannot be recovered. Communications that may have been read cannot be retroactively disavowed. The persistent accounts created in the **45 identified systems** may have planted **secondary access points** not yet discovered. The response is necessary. It is insufficient on its own.

### What Belgium must do — and what NATO must demand

The FortiBleed incident highlights structural gaps in the **cybersecurity of Belgian organizations**: lack of continuous network access monitoring, excessive dependence on third-party solutions without **thorough security auditing**, and the absence of an early-detection protocol adapted to APT threats. These gaps are not unique to Belgium — they are common to most Western administrations and small to mid-sized institutions.

What **Belgium must do** is invest massively in **cyber hygiene training**, regular security audits, and **public-private partnerships** with firms like Secutec that have the expertise to detect advanced intrusions. What **NATO must demand** from its members is a minimum level of **cyber resilience** proportional to the sensitivity of information processed in host countries. Because if Belgian networks are compromised, it is potentially the **entire Atlantic Alliance** that is exposed.

*NATO demands that its members spend 2% of GDP on defense. But how much does it demand on cybersecurity? The twenty-first century's war is also fought in servers. And if we don't defend networks with the same rigor as we defend borders, we lose the next conflict before it even begins.*

## The broader context: the epidemic of Russian cyberattacks against NATO

### Void Blizzard, UNC6508, GREYVIBE — Russia's cyber actors proliferate

FortiBleed is not an isolated incident. In June 2026, the **international cybersecurity community** documented an unprecedented wave of Russian and Chinese cyber operations against NATO member states and their allies. The group **Void Blizzard** had been running campaigns against member states since **April 2024**. A suspected operator of this group, **Denis Obrezko**, was arrested in Thailand and indicted in the United States on **June 10, 2026**.

In the same month, Google revealed the **UNC6508** campaign (China) that had infiltrated American and Canadian medical, academic, and military institutions. The firm **WithSecure** documented the group **GREYVIBE**, a Russian-language actor using **generative AI** tools (ChatGPT, Gemini) to generate sophisticated phishing campaigns against Ukraine. And the **Five Eyes** published on June 22, 2026 a joint warning about state actors' use of AI to reshape offensive cyber capabilities.

### An invisible war with no front line

Cyberwar has no **visible front line**. It has no map on which to track territorial gains and losses. It has no daily human casualty counts to shock consciences. But it is real, it is permanent, and it affects millions of ordinary citizens — in their municipalities, their law offices, their schools — without them being aware of it. That may be its deepest danger: **the invisibility that breeds indifference**.

That indifference is the terrain on which operations like FortiBleed thrive. As long as citizens, businesses, and institutions don't perceive cyberwar as a **concrete threat** to their daily security, cybersecurity investments will remain insufficient. As long as policymakers treat cyber defense as a secondary budget line, Russian hackers will continue to **map our networks** with impunity.

*I want my readers to understand something essential: when Russia compromises Belgian networks, it is not only targeting abstract institutions. It is targeting your lawyer's communications, your municipality's data, your children's school's servers. This war is in your home, in your daily life, and has been for months. You probably didn't know that.*

## What FortiBleed reveals about Russian strategy beyond Ukrainian battlefields

### Russia is using cyberwar to compensate for its military failures

Russia's strategy in Ukraine has suffered significant setbacks. The initial offensive on Kyiv failed in **March 2022**. The **Donbas front** advances at the cost of colossal human losses for limited territorial gain. Economic sanctions are eroding Russia's industrial base. In this context, cyberwar offers Moscow a domain where its investment is **asymmetrically effective**: a few dozen specialized hackers can cause disproportionate damage to hundreds of organizations across dozens of countries.

This imbalance between cost and impact is what makes the **Russian cyber threat** so attractive from a strategic standpoint. An operation like FortiBleed — which compromised **270 Belgian organizations** and **75,000 firewalls worldwide** — likely required a team of a few dozen specialists, a limited budget, and a few months of work. The **cost-effectiveness ratio** is incomparable to that of any conventional military operation.

### Dormant capability — backdoors for future crises

One aspect of FortiBleed deserving particular attention is what experts call **dormant capability**: the persistent access points created in the 45 identified systems may not be intended for immediate use. They may be **strategic assets** held in reserve for a future escalation — a major geopolitical crisis, a direct military confrontation between NATO and Russia, or an escalation scenario in which Moscow would want to strike allied targets in depth.

Under this interpretation, the 270 compromised Belgian organizations are not merely passive intelligence victims — they are **forward positions** in a hybrid warfare infrastructure prepared for the future. This reading, taken seriously by cybersecurity analysts, implies a response that goes beyond simple detection and remediation: it implies a **comprehensive cleansing effort** across all potentially compromised systems, thorough forensic auditing, and a structural overhaul of security practices.

*Backdoors for future crises — that may be the most chilling phrase in everything I've read about FortiBleed. The enemy is not necessarily reading you today. It may be preparing to paralyze you tomorrow, at the most inopportune moment. This is a war being prepared in the shadows. And we're still debating cyber-defense budgets.*

## Toward collective cyber defense — lessons of FortiBleed for NATO and the EU

### Sharing threat intelligence — a reflex that isn't yet automatic

One of FortiBleed's most important lessons is the need for **rapid threat intelligence sharing** between organizations, sectors, and NATO member countries. Secutec published its alert in June 2026 — but how long before information about the Fortinet vulnerability had circulated in closed cybersecurity circles? How many organizations could have protected themselves if information sharing had been faster, broader, **more systematic**?

The EU has made progress in this area with the **NIS2 Directive**, which imposes incident notification obligations on operators of essential infrastructure. But application remains uneven. **Cross-sector collaboration** between private and public actors in the cyber domain is still insufficient. And **cross-border information sharing** — crucial to responding to attacks like FortiBleed that simultaneously target dozens of countries — remains limited by legal obstacles and institutional reluctance.

### Training as the first line of defense

In the vast majority of cases, cyberattacks exploit not sophisticated technological flaws but **human errors**: a click on a malicious link, a weak password, an unused account left active, a **default configuration** never changed. FortiBleed exploited a technical vulnerability — but persistence inside compromised systems was possible in part due to a **lack of human monitoring** of network access.

Investing in **cyber hygiene training** for all employees — from school principals to municipal civil servants, from law firm secretaries to system administrators — is the **most cost-effective measure** an organization can take to reduce its attack surface. It is not glamorous. It is not spectacular. But it is fundamental. And it is the only measure that can both detect and prevent the next FortiBleed before it goes unnoticed for **four months**.

*The West's cyber defense is not won only in intelligence centers or government agencies. It is won in town halls, schools, professional offices. In the decisions of thousands of ordinary people who choose to update their software, report an anomaly, not click the suspicious link. Cybersecurity is a collective responsibility. And we are not there yet.*

## Fortinet and the responsibility of cybersecurity providers

### When the guardian becomes the breach — the accountability of security vendors

There is a profound and troubling irony at the heart of FortiBleed: **Fortinet** is a cybersecurity company. Its product is supposed to **protect networks**. That is why 75,000 organizations worldwide trust it to guard their doors. And it is precisely that trust — materialized in a poorly secured partner portal — that was turned against them. The guardian had become the breach.

This reality raises a fundamental question about the **accountability of cybersecurity vendors**. When a security solutions provider is itself compromised and becomes an attack vector against its customers, who is responsible? Service contracts generally shield providers from legal liability. But the **ethical and reputational responsibility** is another matter. Fortinet's customers have the right to demand full transparency about the extent of the compromise and the measures taken to prevent it from happening again.

### Digital trust as a Western strategic asset

Beyond the Fortinet case, the FortiBleed incident raises a broader question about **digital trust** in the Western ecosystem. Cybersecurity rests on chains of trust: organizations trust their security vendors, vendors trust their partners, partners trust their tools. Every link in this chain is a **potential attack surface**.

Russia and its allies have understood this for a long time. That is why they target partner portals, software update servers, digital certificates — the elements that everyone trusts without questioning. Strengthening digital trust in the Western ecosystem requires not only better securing individual technologies, but fundamentally rethinking how we **validate, audit, and supervise the entire chain of digital trust** on which our institutions rest.

*There is something deeply symbolic in the fact that a cybersecurity vendor was the breach in this affair. It's as if the locksmith who installed your lock had secretly kept a copy of your key. Trust is the foundation of digital security. And when it is compromised at this level, you can't just patch the flaw. You have to rethink the entire architecture of trust.*

## Dark web markets and the monetization of Russian cyberespionage

### Reselling access on the dark web — FortiBleed's economic model

One of the objectives identified by Secutec in the FortiBleed operation was the **resale of compromised access on the dark web**. In at least 45 Belgian systems, the hackers had created persistent accounts — not only for their own use, but also to offer them to **third-party buyers**: other criminal groups, foreign intelligence services, or cybercrime actors seeking entry points into institutional networks.

This economic model — known as **Initial Access Brokers (IAB)** — has become one of the most flourishing industries in international cybercrime. Access to a government network can sell for **anywhere from a few thousand to hundreds of thousands of dollars** on online black markets. Russian hackers therefore have a **dual incentive**: state intelligence on one side, commercial monetization on the other. These two motivations reinforce each other and make the threat even more difficult to contain.

### The 110 million credentials — a strategic resource for years to come

The value of the **110 million credentials** stolen in the FortiBleed operation extends far beyond immediate exploitation. This data constitutes a **durable strategic resource**: credentials change rarely and incompletely, password patterns repeat, and personal information (names, email addresses, phone numbers) retains its value for years. FortiBleed's 110 million credentials could fuel **phishing campaigns, social engineering, and credential stuffing attacks** for a long time to come.

That is why cybersecurity experts recommend that affected organizations not only reset their immediate passwords, but conduct a **comprehensive review of their access policy**: adopting multi-factor authentication, auditing all active accounts, reviewing **access privileges**, and strengthening employee training on the risks of targeted phishing using stolen personal data. Because the 110 million credentials are now in circulation. And they will remain so, available, exploitable, for years.

*110 million credentials. I'm not sure that number is fully understood in its magnitude. These are not just passwords. These are digital identities, access keys, personal histories encoded in databases. These data now circulate in Russian criminal and state networks. And they will remain there, available, exploitable, for years. The damage is done. The question is whether we remember it long enough to change our habits.*

## Ukraine at the center of the target — why Kyiv is concerned by Belgian vulnerabilities

### Belgian networks as a transit point toward decisions on Ukraine

To understand why Belgium is a particularly sensitive target, one must look at the flow of decisions that converge on Brussels concerning **Ukraine**. It is in Brussels that decisions on sanctions against Russia are made. It is in Brussels that EU military aid packages are negotiated. It is in Brussels that NATO is headquartered, where decisions on weapons deliveries, troop rotations, and collective defense plans are discussed in meetings whose content is invaluable to Moscow.

Infiltrating a Belgian network — a municipality, a law firm, a school — may seem trivial. But within the **interconnected network** of Brussels institutions, every compromised node is potentially a corridor toward more sensitive information. Municipal civil servants sometimes have access to regional networks connected to national networks themselves connected to allied networks. This is the **six degrees of separation theory** applied to cyberwar: there may be only a few hops between a suburban Brussels school and **NATO's servers**.

### Zelensky, the allies, and strategic information warfare

The government of **Volodymyr Zelensky** has made transparency about Russian cyberattacks a conscious political strategy. By documenting and making public the Russian attacks against Ukrainian and allied infrastructure, Kyiv builds a dossier of accusation against Moscow before international opinion. Secutec's alert about FortiBleed fits into this context: every documented incident, every public attribution, weakens the Russian narrative that cyberwar is merely a Western construct.

For Ukraine, every compromised allied network is an **additional motivation** for its partners to invest in collective cyber defense. A Belgian government that sees its own networks compromised by Russian actors better understands the daily reality that Ukrainian institutions have lived with since 2014. This **solidarity through shared vulnerability** may be one of the unintended but real effects of FortiBleed: transforming Belgian victims into even more committed defenders of the Ukrainian cause.

*There is something profoundly Ukrainian about what the 270 Belgian organizations hit by FortiBleed are experiencing today. That experience of being infiltrated without knowing it, of discovering that the enemy was in your walls for months, that your data was read by strangers in the service of a hostile power — Ukraine has lived with that since 2014, at an infinitely larger scale. Perhaps these 270 organizations will understand better now why Zelensky says what he says.*

## Prospects: Russian cyberwar in 2026 and beyond

### The predictable intensification of Russian cyber operations

Experts agree on one point: the Russian cyberwar against the West will **intensify, not subside**. The military and economic pressures that Russia faces in Ukraine push it to seek asymmetric levers of pressure against its adversaries. Cyberwar is precisely that lever: low-cost, effectively deniable, and capable of inflicting real damage on civilian and institutional targets without crossing the threshold of conventional war.

In this context, FortiBleed is not the last attack of its kind. It will be one of the first in a series that experts project will be **more frequent, more sophisticated, and broader** in scope in the years ahead. The **Five Eyes** warned in June 2026 that the integration of AI into offensive cyber capabilities would reshape the threat "in months, not years." The challenge for the West is to strengthen its defenses faster than the adversary improves its attacks.

### What Belgium can do for Europe — a resilience model to build

Belgium has the opportunity, post-FortiBleed, to become a **model of cyber resilience** for Europe. It has the necessary assets: quality technical expertise (as shown by Secutec's work), a central institutional position (NATO and EU headquarters), and reinforced political motivation from the scale of the compromise. What it lacks is a **massive, coordinated investment** in cyber defense at the national and local level.

If Belgium takes FortiBleed seriously — not merely as a technical incident to manage, but as a strategic alarm signal about its **systemic vulnerability** — it can make it the starting point for a transformation of its national cyber architecture. A transformation that would benefit not only Brussels, but all the allies whose interests converge in the Belgian capital. Because in the twenty-first century's cyberwar, **security is collective or it is nothing**.

*Belgium has everything it needs to become a model of cyber resilience in Europe. It has the expertise, it has the position, it now has the motivation. What it doesn't yet have is the political will to transform an embarrassing incident into a catalyst for systemic transformation. I hope FortiBleed will be that catalyst. Because next time, the alert may come too late.*

## Conclusion: FortiBleed is an alert, not an isolated case

### 270 Belgian organizations — but how many worldwide?

The **270 Belgian organizations** identified by Secutec represent only a fraction of FortiBleed's global exposure. With **75,000 firewalls compromised** worldwide, Belgium is one of dozens of affected countries. Belgium was fortunate enough to have a cybersecurity firm capable of detecting and documenting the operation. How many other countries have not yet detected their own FortiBleed?

This question — without a certain answer — should sit at the center of cybersecurity discussions in every Western government. Not tomorrow. Now. Because while policymakers debate budgets and procedures, Russian hackers continue to map, position, and prepare. The **threat does not pause**. The response cannot either.

### What FortiBleed demands of us collectively

FortiBleed demands several things of us collectively. It demands that **governments invest in cyber defense** commensurate with the threat — not in speeches, but in real budgets and deployed capabilities. It demands that **private and public organizations** take cyber hygiene as seriously as physical security. It demands that **NATO and the EU** strengthen their threat intelligence sharing architecture. And it demands that **citizens** understand that this invisible war concerns them directly.

Russia is not only bombing Kyiv. It is mapping our networks from Brussels, from Berlin, from Washington. It is preparing tomorrow's wars inside today's servers. And we, in the meantime, are still debating whether cybersecurity truly deserves a serious budget line. **FortiBleed should end that debate**. For good.

## Balance sheet of an invisible war — what Russian cyberwar truly costs the West

### The invisible cost: trust, resources, time

Beyond the stolen data and compromised access points, the FortiBleed operation carries a cost that is not easily measured: the cost of **eroded trust**. The 270 Belgian organizations must now ask themselves: what was read? What was exfiltrated? Which files, communications, and plans were exposed? This persistent uncertainty — this inability to know with certainty what was compromised — is itself a form of **strategic damage** that the attacker can claim as a win.

Added to this is the resource cost: **forensic audits**, system resets, cybersecurity consultants, emergency training, access policy overhauls. For a rural municipality or a small law firm, these costs are significant. For all 270 affected organizations combined, they are considerable. And for the tens of thousands of organizations affected worldwide by FortiBleed, they represent a **real economic drain on Western resources** — which is, precisely, one of the strategic objectives of Russian cyberwar.

### Resistance as a political act — refusing to let fatigue win

Faced with the scale and continuity of the Russian cyber threat, there is a real risk: **fatigue**. The fatigue of defending against a permanent, invisible threat that constantly evolves. The temptation to give up, to tell oneself it's inevitable, that not everything can be controlled. That is precisely what Moscow hopes for: that the accumulation of incidents, alerts, and endless breaches will eventually **normalize compromise** and discourage investment in cyber defense.

Resisting that fatigue is a **political act**. Continuing to invest, to train, to share information, to demand vendor transparency, to support firms like Secutec that do this essential work of detection and documentation — that is refusing to let Russia win this war of digital attrition. It is defending not only our networks, but our values, our **strategic autonomy**, and our right to a digital life free from hostile surveillance.

*The alert from Secutec came from a private firm, not a state. Detection, documentation, warning — all of it came from the private sector, not from the government agencies supposedly protecting us. If our governments cannot detect a breach inside 270 of their own organizations, what confidence can we have in our collective cyber-defense architecture? That is the question FortiBleed forces us to ask.*

*Russia's cyberwar against the West is a war of attrition. Its objective is not a decisive victory in a single strike. It is to exhaust, to normalize, to discourage. To make us eventually accept that being compromised is inevitable. FortiBleed reminds us that this acceptance would be defeat. And defeat is not an option. Not while a democracy fights for its survival a few thousand kilometers from Brussels.*

**By Maxime Marquette, columnist**

## Columnist's transparency note

### Editorial stance

I am not a journalist but a **columnist and analyst**. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. **I claim analytical clarity**, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

### Method and sources

This text keeps the basic distinction between **verified facts and interpretive analysis**. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under **Sources**, never here.

**Primary source families** used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

**Secondary source families**: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under **Sources**.

### Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a **critical, contextual synthesis** based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.

## Sources

### Primary sources

- [Brussels Times — At least 270 Belgian organisations targeted by ongoing Russian cyberattack — June 2026](https://www.brusselstimes.com/2204554/at-least-270-belgian-organisations-targeted-by-ongoing-russian-cyberattack)

- [Eastern Herald — Russian hackers exploit NATO firewalls in major cyberattack 2026 — June 19, 2026](https://easternherald.com/2026/06/19/russian-hackers-nato-firewall-cyber-attack-2026/)

- [Cybersecurity Journal Canada — Cybersecurity Daily Brief — June 16, 2026](https://cybersecurityjournal.ca/news/84244-cybersecurity-daily-brief-2026-06-16/)

### Secondary sources

- [Foundation for Defense of Democracies — FBI web domain seizures highlight China's virtual espionage strategy — June 15, 2026](https://www.fdd.org/analysis/2026/06/15/fbi-web-domain-seizures-highlight-chinas-virtual-espionage-strategy/)

- [Ankura CTIX — Flash Update on cyber threats including GREYVIBE — June 2, 2026](https://ankura.com/de/insights/ankura-ctix-flash-update-june-2-2026)

- [The New York Times — Operation Jaguar: new revelations on Russian cyberespionage in Europe — June 26, 2026](https://www.nytimes.com/2026/06/26/world/europe/jaguar-russia-hack.html)

---

Source: Maxime Marquette, MadMax. When citing, name the author and link https://mad-max.co/en/article/portrait-fortibleed-le-groupe-russe-qui-a-compromis-270-organisations-belges-san