[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYP_pMHX0QltO3fimS-Sjq1Ttl46s1cCosVN7uCBlqG0":3},{"article":4,"iocs":49,"watch_terms":75,"solutions":76,"lesson":168},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"e28ea805-6bcc-4952-b96e-13fb33590b77","FBI Warns FortiBleed Campaign Still Active, Hits 86,000+ FortiGate Devices","fbi-warns-fortibleed-campaign-still-active-hits-86-000-fortigate-devices-ea16bb","FortiBleed attacks continue to target Fortinet FortiGate devices, with SOCRadar reporting more than 86,644 compromised devices across 194…","The FBI and US Secret Service have issued a joint advisory warning that the FortiBleed campaign, which targets Fortinet FortiGate devices, remains active. The campaign leverages stolen credentials from previous leaks and infostealer logs, using techniques like credential stuffing and password spraying, to gain access to over 86,000 devices globally. Attackers then modify account settings, lock out legitimate administrators, and have been linked to ransomware operations like INC Ransom, Lynx, and Payload.","FBI warns FortiBleed campaign targeting FortiGate devices is still active, impacting over 86,000 devices.","https:\u002F\u002Fhackread.com\u002Ffbi-fortibleed-campaign-active-fortigate-devices\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Ffbi-fortibleed-campaign-active-fortigate-devices.jpg","2026-10-09T10:38:49+00:00","2026-10-09T12:00:09.766734+00:00",9,[17,20,23],{"name":18,"type":19},"FortiGate","product",{"name":21,"type":22},"Fortinet","vendor",{"name":24,"type":25},"FortiBleed","campaign","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":26,"icon":28,"name":29,"slug":30},null,"Threat Intelligence","threat-intelligence",[32,37,42,47],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":26,"icon":28,"name":29,"slug":30},[50,54,57,60,63,66,69,72],{"type":51,"value":52,"context":53},"mitre_attack","T1110","Credential stuffing and password spraying",{"type":51,"value":55,"context":56},"T1003","OS Credential Dumping (via legacy SHA-256 storage)",{"type":51,"value":58,"context":59},"T1547.001","Create or Modify System Process: Registry Run Keys \u002F Startup Folder (implied by persistence via account changes)",{"type":51,"value":61,"context":62},"T1078.004","Valid Accounts: Default Accounts (suspicious admin account names)",{"type":51,"value":64,"context":65},"T1071.001","Application Layer Protocol: Web Protocols (for scanning and access)",{"type":51,"value":67,"context":68},"T1071.004","Application Layer Protocol: DNS (for scanning and enumeration)",{"type":51,"value":70,"context":71},"T1059.003","Command and Scripting Interpreter: Windows Command Shell (for enumeration)",{"type":51,"value":73,"context":74},"T1070.004","Indicator Removal: File Deletion (implied by removing accounts)",[21,18],{"controls":77,"vendors":162},[78,107,136],{"slug":79,"name":80,"problem":81,"products":82},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":108,"name":109,"problem":110,"products":111},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":137,"name":138,"problem":139,"products":140},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[141,149,154],{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":150,"product_name":151,"url":152,"description":153},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":155,"vendor_name":156,"vendor_logo":157,"product_slug":158,"product_name":159,"url":160,"description":161},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[163],{"slug":164,"name":21,"logo_path":165,"roles":166},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[167],"affected",{"slug":169,"title":170,"body":171,"framework_refs":172,"framework_notes":185},"fortibleed-campaign-compromises-86000-devices-via-stolen-credentials","FortiBleed Campaign Compromises 86,000+ Devices via Stolen Credentials","The FortiBleed campaign exploits credentials stolen from prior data breaches and infostealer malware logs to gain unauthorized access to FortiGate devices through credential stuffing and password spraying — techniques that succeed when organizations fail to rotate credentials after known leaks or enforce multi-factor authentication. Once inside, attackers modify account configurations and lock out legitimate administrators, effectively handing persistent control to threat actors. This campaign's link to active ransomware groups like INC Ransom and Lynx underscores the real-world damage that can stem from unaddressed credential hygiene failures. The scale — over 86,000 devices — illustrates how internet-facing network appliances with weak or reused credentials present a massive, systematic attack surface that adversaries actively exploit.",[173,174,175,176,177,178,179,180,181,182,183,184],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-7 – Unsuccessful Logon Attempts","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-53 SI-2 – Flaw Remediation","NIST CSF ID.AM-1 – Physical Devices and Systems Inventoried","NIST CSF PR.AC-1 – Identities and Credentials Managed","GDPR Article 32 – Security of Processing (for EU-exposed devices)","ITIL Change Management – Emergency Patch Procedures",{}]