THREATOPS
THREAT OPSThreat News › FortiBleed Credential Theft Campaign Marches On

FortiBleed Credential Theft Campaign Marches On

medduo_decipherPublished 2026-06-18

<p class="wp-block-paragraph">The large-scale, automated campaign known as FortiBleed is still ongoing and to this point has successfully compromised more than 86,000 Fortinet firewall and VPN gateway devices across 194 countries. </p>

<p class="wp-block-paragraph">Researchers at SOCRadar discovered the operation a few days ago and found that it relied on an exposed operational server that cont

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://decipher.sc/2026/06/18/fortibleed-credential-theft-campaign-marches-on/