[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVxn55TBayqQuJ6Tg1jUE2YlFWqkIJLhUypXrJFqN7Cw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":57},"1b838ab3-aca4-4c96-955f-e96f2cc90b29","fortibleed-110m-credentials-harvested-via-unpatched-fortigate-firewalls","f377a7a4-2109-4917-8a81-ff776c1ea081","FortiBleed: 110M Credentials Harvested via Unpatched FortiGate Firewalls","The FortiBleed operation demonstrates the catastrophic consequences of failing to patch internet-facing network appliances in a timely manner. A Russian-speaking initial access broker exploited diagnostic command functionality in FortiOS to passively harvest over 110 million credentials — including RADIUS, NTLM, and Kerberos tokens — across more than 430,000 exposed FortiGate devices. The sheer scale of credential theft means compromised organizations face cascading lateral movement risk across their entire infrastructure. This campaign underscores that perimeter security devices are high-value targets precisely because they sit at the trust boundary, making unpatched vulnerabilities in firewalls uniquely dangerous compared to typical endpoint exposures.","**Immediate Actions:**\n- Apply the latest FortiOS patches or firmware updates to all FortiGate devices without delay, prioritizing internet-facing instances.\n- Audit and rotate all credentials that may have transited FortiGate devices since February 2026, including RADIUS, NTLM, Kerberos, and database tokens.\n- Restrict or disable unnecessary FortiOS diagnostic and CLI commands accessible via management interfaces.\n\n**Detection Measures:**\n- Deploy network-based monitoring to detect anomalous authentication traffic patterns or unexpected use of FortiOS diagnostic APIs.\n- Threat-hunt for indicators of compromise associated with the FortigateSniffer Golang-based tool across firewall logs and network telemetry.\n- Enable centralized SIEM ingestion of FortiGate logs to identify credential harvesting behavior in near real-time.\n\n**Long-Term Improvements:**\n- Enforce a strict patch SLA (e.g., 72 hours) for critical vulnerabilities on all internet-facing network appliances and enforce it via automated compliance checks.\n- Implement out-of-band, dedicated management networks for all firewall and network appliance administration to reduce exposure of diagnostic interfaces.\n- Adopt a Zero Trust architecture to limit the blast radius if perimeter device credentials are compromised, ensuring stolen tokens cannot enable unrestricted lateral movement.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-17: Remote Access","NIST SC-7: Boundary Protection","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1557: Adversary-in-the-Middle (Credential Interception)","ISO\u002FIEC 27001:2022 A.8.8: Management of Technical Vulnerabilities","GDPR Article 32: Security of Processing (credential data breach implications)",{},"published","2026-06-23T22:21:20.03499+00:00","2026-06-23T22:21:19.934+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Ffortibleed-targeted-fortigate-firewalls.html","fortibleed-targeted-fortigate-firewalls-in-110-million-credential-harvesting-ope-fa20be","FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[51],{"id":52,"date":53,"edition":54,"title":55,"audio_url":56},"5bc7e3c3-dee0-46ff-9ef7-05c7ec869ea4","2026-06-24","morning","ThreatNoir Morning Brief — June 24","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-06-24\u002Fthreatnoir-morning-brief-2026-06-24.mp3",[58,62,65],{"slug":59,"name":60,"problem":61},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":35,"name":63,"problem":64},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":66,"name":67,"problem":68},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]