[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyvSTOCZZm3tuRFlBGPEJesEZkRui-fthO4UZgvp_0k8":3},{"article":4,"iocs":56,"watch_terms":69,"solutions":70,"lesson":174},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"f377a7a4-2109-4917-8a81-ff776c1ea081","FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation","fortibleed-targeted-fortigate-firewalls-in-110-million-credential-harvesting-ope-fa20be","A Russian-speaking initial access broker (IAB) driven by financial gain is assessed to be behind a large-scale credential-harvesting operation known as FortiBleed that has targeted over 430,000 FortiGate firewalls globally. The campaign, active since February 2026, involves collecting credential lists, searching for exposed services, brute-forcing accessible systems, and deploying bespoke","A Russian-speaking initial access broker is behind the FortiBleed operation, targeting over 430,000 FortiGate firewalls globally since February 2026. The campaign harvests credentials using a Golang-based tool called FortigateSniffer, which exploits FortiOS diagnostic commands to capture authentication traffic. The operation has collected over 110 million credentials, including RADIUS, NTLM, Kerberos, and MySQL tokens, and appears to be part of a broader multi-vendor initial access campaign.","FortiBleed operation harvests 110 million credentials from FortiGate firewalls.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Ffortibleed-targeted-fortigate-firewalls.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhJkhDD5qINhfAhBFXG2C13raQF6T6zAOmnHlArhnLUP5z0ifBzpyq6M_4n11cgynQfZW0mxJWnYU-TDYSpKQHYFHvXsZHCB7uoMFg0w02yZILY-JLMm2-uqm-CA_wIqZHhzl25FfO_lMd7dYm6VfprDP83bz_SoB3MWLEc059E4YCa554bba-qWHW5udHv\u002Fs1600\u002Ffortigate.jpg","2026-06-23T18:20:49+00:00","2026-06-23T22:00:32.790321+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"FortiGate","product",{"name":21,"type":22},"Fortinet","vendor",{"name":24,"type":25},"Firewall","technology",{"name":27,"type":25},"Active Directory",{"name":29,"type":25},"SSH",{"name":31,"type":32},"FortiBleed","threat_actor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":33,"icon":35,"name":36,"slug":37},null,"Threat Intelligence","threat-intelligence",[39,44,49,54],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":55},{"id":33,"icon":35,"name":36,"slug":37},[57,60,63,66],{"type":53,"value":58,"context":59},"FortigateSniffer","Golang-based tool used to capture authentication traffic from FortiGate firewalls.",{"type":53,"value":61,"context":62},"FortiProbe-fast","Custom utility used for filtering FortiGate systems.",{"type":53,"value":64,"context":65},"forticheck","Credential checker tool targeting FortiGate administrative panel and SSL-VPN portal.",{"type":53,"value":67,"context":68},"HASHBOT","Telegram bot used to orchestrate password hash cracking.",[21,18],{"controls":71,"vendors":156},[72,101,130],{"slug":73,"name":74,"problem":75,"products":76},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[77,85,93],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":102,"name":103,"problem":104,"products":105},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":131,"name":132,"problem":133,"products":134},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[135,143,148],{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":144,"product_name":145,"url":146,"description":147},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",[157,163,167,172],{"slug":158,"name":159,"logo_path":160,"roles":161},"citrix","Citrix","\u002Fvendor-logos\u002Fcitrix.png",[162],"affected",{"slug":164,"name":21,"logo_path":165,"roles":166},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[162],{"slug":168,"name":169,"logo_path":170,"roles":171},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[162],{"slug":149,"name":150,"logo_path":151,"roles":173},[162],{"slug":175,"title":176,"body":177,"framework_refs":178,"framework_notes":190},"fortibleed-110m-credentials-harvested-via-unpatched-fortigate-firewalls","FortiBleed: 110M Credentials Harvested via Unpatched FortiGate Firewalls","The FortiBleed operation demonstrates the catastrophic consequences of failing to patch internet-facing network appliances in a timely manner. A Russian-speaking initial access broker exploited diagnostic command functionality in FortiOS to passively harvest over 110 million credentials — including RADIUS, NTLM, and Kerberos tokens — across more than 430,000 exposed FortiGate devices. The sheer scale of credential theft means compromised organizations face cascading lateral movement risk across their entire infrastructure. This campaign underscores that perimeter security devices are high-value targets precisely because they sit at the trust boundary, making unpatched vulnerabilities in firewalls uniquely dangerous compared to typical endpoint exposures.",[179,180,181,182,183,184,185,186,187,188,189],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-17: Remote Access","NIST SC-7: Boundary Protection","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1557: Adversary-in-the-Middle (Credential Interception)","ISO\u002FIEC 27001:2022 A.8.8: Management of Technical Vulnerabilities","GDPR Article 32: Security of Processing (credential data breach implications)",{}]