TLDR Tech / InfoSec
Threat Brief: Mitigating Large-Scale Credential Attacks
FortiBleed is a large-scale password-spraying and credential-theft campaign targeting internet-exposed Fortinet, Sophos, and MSSQL services. It uses a multi-stage chain of spraying, privilege escalation, configuration extraction using stored credentials, and offline cracking that feeds the next round. An IAB on Exploit[.]in claims responsibility and sells harvested credentials as of June 16 (unvalidated). Defenders should audit remote access logs for successful logins following high-volume failure events, require MFA, adopt ZTNA with jump boxes to keep management interfaces off the public internet, rotate default credentials, disable unused accounts, and patch local privilege escalation flaws.
Read the full story