InfoSecBulletin Cybersecurity for mankind
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh. In an advisory CIRT said, the campaign has been observed globally, affecting organizations across 194 countries.
The systems have the “fortibleed” label, meaning they might be at risk for losing login details and being accessed without permission due to issues with FortiGate.
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
The FortiBleed campaign is a big effort to steal login info from Fortinet FortiGate devices that connect to the internet. Reports show that hackers are taking advantage of FortiGate systems that were hacked or had flaw before to get login details and keep access to business networks.
FortiBleed is different from usual remote code attacks. It mainly aims to steal and reuse login details instead of launching attacks right away. The stolen credentials let attackers get past security barriers and log in as real users using FortiGate SSL-VPN services.
FortiBleed Attack Lifecycle: From Credential Theft to Ransomware
The FortiBleed campaign starts with scanning the internet for weak FortiGate SSL-VPN devices. After finding them, attackers steal important login information like usernames, passwords, session cookies, VPN settings, and tokens to access the devices without using brute-force methods.
After getting into the VPN, bad actors look around inside, check Active Directory, steal login info using tools like Mimikatz, gain higher access, and spread across the network using RDP, SMB, PsExec, WinRM, and WMI. Often, this leads to stealing data and installing ransomware, using methods linked to groups like Akira ransomware, LockBit, INC Ransom, Play ransomware, and Black Basta.
Key signs of unusual behavior are strange VPN logins, odd login locations, checking Active Directory, collecting Kerberos tickets, spreading passwords, stuffing credentials, and illegal remote admin actions. All of these should be seen as possible signs of being compromised.
FortiBleed Detection & Monitoring
Organizations should improve monitoring on FortiGate firewalls, SSL-VPN systems, and Active Directory to find signs of FortiBleed-related issues and misuse of credentials.
FortiGate Appliances: Watch for unauthorized logins by admin, unexpected changes in settings, firmware updates, exports of settings, and strange login activity.
Organizations using FortiGate devices should quickly check if their systems are affected, change all passwords linked to FortiGate devices, look at login records, and search for signs of unauthorized access.
