InfoSecBulletin Cybersecurity for mankind
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh. In an advisory CIRT said, the campaign has been observed globally, affecting organizations across 194 countries.
The systems have the “fortibleed” label, meaning they might be at risk for losing login details and being accessed without permission due to issues with FortiGate.
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
“PentesterFlow” AI Automation Tool for Penetration Testers and Bug Hunters
Jailbreak works against AI Models GPT-5.6, Claude Opus 5, and Fable, Claims Researcher
Researchers found security flaws in every script generated by ChatGPT, Copilot, and Gemini
Australian Energy Giant Origin confirms unauthorized access and disclosure of customer data
Anthropic Unveils Claude Security Plugin for Code Flaw Scanning
Apple, ASUS Router, Meta, Windmill & Ubuntu Patch Critical Security Flaws
The FortiBleed campaign is a big effort to steal login info from Fortinet FortiGate devices that connect to the internet. Reports show that hackers are taking advantage of FortiGate systems that were hacked or had flaw before to get login details and keep access to business networks.
FortiBleed is different from usual remote code attacks. It mainly aims to steal and reuse login details instead of launching attacks right away. The stolen credentials let attackers get past security barriers and log in as real users using FortiGate SSL-VPN services.
FortiBleed Attack Lifecycle: From Credential Theft to Ransomware
The FortiBleed campaign starts with scanning the internet for weak FortiGate SSL-VPN devices. After finding them, attackers steal important login information like usernames, passwords, session cookies, VPN settings, and tokens to access the devices without using brute-force methods.
After getting into the VPN, bad actors look around inside, check Active Directory, steal login info using tools like Mimikatz, gain higher access, and spread across the network using RDP, SMB, PsExec, WinRM, and WMI. Often, this leads to stealing data and installing ransomware, using methods linked to groups like Akira ransomware, LockBit, INC Ransom, Play ransomware, and Black Basta.
Key signs of unusual behavior are strange VPN logins, odd login locations, checking Active Directory, collecting Kerberos tickets, spreading passwords, stuffing credentials, and illegal remote admin actions. All of these should be seen as possible signs of being compromised.
FortiBleed Detection & Monitoring
Organizations should improve monitoring on FortiGate firewalls, SSL-VPN systems, and Active Directory to find signs of FortiBleed-related issues and misuse of credentials.
FortiGate Appliances: Watch for unauthorized logins by admin, unexpected changes in settings, firmware updates, exports of settings, and strange login activity.
Organizations using FortiGate devices should quickly check if their systems are affected, change all passwords linked to FortiGate devices, look at login records, and search for signs of unauthorized access.
