Threat Pulse 62High
FBI: FortiBleed attacks still active, locking admins out of FortiGate VPNs
Severity 7ActiveconfirmedWeb servers and gatewaysGovernment

The FBI warned that FortiBleed operators are still breaking into exposed FortiGate firewalls and SSL VPNs using leaked credentials, infostealer logs and password spraying, cracking password hashes on GPU clusters and creating admin accounts that lock out real administrators. The access is resold to ransomware affiliates including INC, Lynx and Payload.

What to do: FBI: restrict external access, terminate VPN sessions, enforce MFA and PBKDF2 hashing; patching alone is not enough.

· 30 days ago · 86,644 compromised devices per SOCRadar · FBI
SourcesFBIBleepingComputerDecipher
Why this score

Tens of thousands of organizations (impact 2), active mass exploitation (exploitability 3), ransomware entry point into critical sectors (criticality 1), campaign unresolved (+1).

Back to the board

Updated Nov 5, 01:48 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.