A sweeping automated credential exploitation and passive traffic harvesting campaign has reached critical scale, compromising tens of thousands of active network boundaries. The attack profile combines leaked historical credentials with un-rotated factory default parameters to bypass perimeter authorization check rules entirely.
Active tracking data confirms that the FortiBleed intrusion cluster has successfully breached 86,644 distinct FortiGate firewall installations globally as of June 19, 2026. Attributed to Russian-speaking cybercrime networks, the automated attack vector targets exposed remote login portals using specialized credential-spraying engines. Upon gaining access via default system profiles or unpatched administrative gates, the malware embeds automated script blocks inside network drivers to passively monitor unencrypted transit data streams and harvest secondary credentials.
Allowing threat actors to gain visibility over perimeter traffic layers neutralizes standard corporate access controls. Once the core gateway configuration is modified, adversaries can intercept corporate verification data, map internal database tables, and prepare covert lateral routes to compromise adjacent application nodes without triggering local event logs.
– Conduct an immediate operational check to identify and rename default administrative account profiles on all FortiGate endpoints.
– Enforce strict mandatory password rotation rules across all system and organization-specific gateway access groups.
– Restrict gateway remote login interfaces from public internet routing, gating administrative controls behind isolated subnets.
– Monitor perimeter logs for anomalous outbound connections or unmapped background data replication streams.
Boundary protection stability relies on absolute configuration hygiene to ensure that exposed administrative profiles do not facilitate automated perimeter takeovers. #CodeDefence #Fortinet #FortiGate #FortiBleed #VPNSecurity #CISA
/
