FlagThis - Latest Cybersecurity News

The 'FortiBleed' campaign targeted approximately 74,000 internet-facing Fortinet FortiGate firewalls across 194 countries. Threat actors exploited an open directory vulnerability or misconfiguration to extract configuration files containing authentication hashes. Utilizing a specialized 45-GPU cluster, attackers conducted an estimated 1.16 billion brute-force attempts to crack these hashes, gaining unauthorized administrator and SSL VPN access. This initial perimeter breach served as a gateway for lateral movement into internal enterprise networks, specifically targeting Active Directory (AD) for privilege escalation and full domain compromise.

Nation-state threat actors are pivoting from traditional endpoint attacks to "Edge-to-Core" escalation, weaponizing unpatched or End-of-Life (EOL) F5 BIG-IP appliances to bypass perimeter defenses. By exploiting the implicit trust between edge devices and internal infrastructure, attackers are successfully pivoting through internal SaaS applications to achieve full Identity and Active Directory compromise.

Adversaries are increasingly deploying Large Language Models (LLMs) to automate the "operator" role within offensive workflows, specifically targeting Active Directory (AD) environments. By integrating LLMs into post-exploitation frameworks, threat actors automate identity-based reconnaissance, AD enumeration, and lateral movement. This automation enables the rapid generation of polymorphic malware payloads designed to bypass Endpoint Detection and Response (EDR) and XDR solutions through continuous, automated evasion testing. This shift significantly accelerates the timeline from initial access to full domain compromise, allowing for scalable, human-like exploitation of enterprise identity perimeters and privileged accounts.