TLDR Tech / InfoSec
An update on FortiBleed — what's happening with victim orgs
An attacker scanned for internet-facing FortiGate boxes, logged in through prior unpatched vulnerabilities or dormant backdoor admin accounts (some planted earlier by a Russian ransomware crew reusing identical passwords), exported full device configs, then cracked the hashes offline on 36 rented enterprise GPUs before reselling the plaintext as FortiVPN client credentials. Roughly a thousand orgs were confirmed internally compromised, with operators adding rogue admin accounts, opening SSH and RDP firewall rules, and authenticating to IPsec tunnels while focusing on telcos and MSPs to pivot into downstream networks. Defenders should filter FortiOS logs under System, Events for config export messages, check their internet-facing IPs and Fortiguard-ID domains against the published FortiBleed lists, and if listed, rebuild the box, purge and recreate all admin accounts with MFA, patch to current firmware, and rotate IPsec site-to-site keys at both ends.
Read the full story