Attributed metadata history
Up to 100 retained publisher events per page for 85fb0c0b7193aaed72c6044c39f56f9f0b3cb6db3e7f6fd9fcf1f995598ca183. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_cdcffed32aa78fd61f
observed · 2026-10-12 15:25:04 UTC
Details from an FBI investigation into the ongoing FortiBleed attacks reveal that victims could be locked out of their own firewall even as attackers remain logged in. After gaining access to a backend server left exposed by the attackers, the FBI and US Secret Service have shared new details of an operation that has already affected more than 80,000 devices worldwide. The server gave investigators a look at the infrastructure behind the operation, including systems used to process stolen credentials, crack password hashes, and identify potential targets. The operators were also found ranking organizations based on their revenue and network structure, the FBI said in an advisory. “FortiBleed isn’t a vulnerability story anymore,” said Muhammad Yahya Patel, vCISO, cybersecurity advisor EMEA at Huntress. “It’s a persistence story. The credentials were taken months ago. The question every organization needs to answer is whether they’re still being used right now.” Attackers have created administrative accounts, enumerated Active Directory environments, and used compromised credentials for lateral movement, the FBI added. Access obtained through the campaign ha
Fingerprint: afba2e87850b3464296b4d0d409b97fb308b86d9b8b49127c22752669c935b68
intelligence_src_cdcffed32aa78fd61f
observed · 2026-10-12 15:25:03 UTC
available
Fingerprint: 7058adebc821bb9d551a9ff0b80ac7c4e28d07e4464aca030b831463a16c18c5