FlagThis — Daily Cybersecurity Intelligence Briefing

The 'FortiBleed' campaign targeted approximately 74,000 internet-facing Fortinet FortiGate firewalls across 194 countries. Threat actors exploited an open directory vulnerability or misconfiguration to extract configuration files containing authentication hashes. Utilizing a specialized 45-GPU cluster, attackers conducted an estimated 1.16 billion brute-force attempts to crack these hashes, gaining unauthorized administrator and SSL VPN access. This initial perimeter breach served as a gateway for lateral movement into internal enterprise networks, specifically targeting Active Directory (AD) for privilege escalation and full domain compromise.

The FortiBleed campaign leverages a suspected zero-day vulnerability in FortiGate VPN devices to facilitate mass credential theft. This operation serves as a dedicated initial access pipeline for the INC and Lynx ransomware groups, orchestrated by a single operator managing both the exploit infrastructure and ransomware negotiation panels. The campaign results in high-velocity deployment of ransomware following the compromise of verified VPN credentials, bypassing traditional perimeter defenses. Impact is characterized by widespread unauthorized access to corporate environments and subsequent data encryption.

Fortinet FortiSandbox is under active exploitation via a cluster of critical vulnerabilities, most notably CVE-2026-25089 and CVE-2026-26083 (CVSS 9.8). Attackers leverage OS Command Injection (CWE-78) and Missing Authorization (CWE-862) to execute arbitrary commands with high privileges without authentication. This is often chained with CVE-2026-39813 (Path Traversal in the JRPC API) and CVE-2026-39808 to bypass security controls and gain full system access. The primary impact is the complete compromise of the sandbox appliance, allowing adversaries to manipulate the malware analysis environment and potentially pivot deeper into the corporate network.