Russian Initial Access Broker Behind FortiBleed Campaign

By Ionut Arghire

AI Summary

A Russian initial access broker behind the 'FortiBleed' campaign deployed a custom Golang-based sniffer targeting 430,000 FortiGate firewalls, capturing over 110 million credentials since at least February 2026. The campaign repurposes compromised FortiGate devices as credential-harvesting infrastructure, posing an outsized risk to organizations that have not fully remediated known FortiOS vulnerabilities.

Read full article → https://www.securityweek.com/russian-initial-acces…

Relevance score: 82.0/100

# More from June 25

1
Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access BleepingComputer
2
Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered The Hacker News
3
Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root The Hacker News
4
macOS Weaknesses Chained to Silently Disable Endpoint Security Agents SecurityWeek
5
New ‘Mistic’ RAT Opens Door to Several Ransomware Families SecurityWeek
7
Trump Signs Executive Order Accelerating Post-Quantum Cryptography Migration SecurityWeek
8
Scattered Spider members plead guilty to hacking Transport for London BleepingComputer
9
Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks The Hacker News
10
DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering The Hacker News