FortiBleed: 75,000 Firewalls Cracked, Defender Zero-Day Has No Fix, and the Hacker Who Stayed 33 Days
Friday, June 19, 2026 · 5-minute read
A data dump nicknamed "FortiBleed" has exposed what researchers say are valid credentials for roughly 75,000 Fortinet FortiGate firewall devices across 194 countries. The list includes organizations like Chevron, Samsung, Foxconn, AT&T, and Toyota, with a Turkish NATO defense contractor allegedly among the fully compromised victims. Security researcher Bob Diachenko found a server where attackers had left their tooling exposed — including logs showing roughly 1.16 billion brute force attempts against 320,000+ FortiGate targets. A 45-GPU cluster was apparently used to crack intercepted password hashes. The source of the data — whether it came from a known or new Fortinet flaw — is still unknown. Security researcher Kevin Beaumont confirmed some of the admin credentials are real. Hudson Rock has published a free lookup tool at hudsonrock.com/fortinet to check if your organization is in the dataset.
Source: BleepingComputerThe DragonForce ransomware group deployed a custom backdoor called Backdoor.Turn against a major U.S. services firm, and it used a clever trick to avoid detection: it routed all command-and-control (C2) traffic through legitimate Microsoft Teams relay servers. From a defender's perspective, the only traffic visible was normal Teams connections — the real attacker was hiding inside them. The attackers were inside the victim network for between one and two months. Researchers at Symantec and Carbon Black published the technical breakdown this week, calling DragonForce one of the most capable ransomware groups currently active.
Source: The Hacker NewsIndia temporarily blocked Telegram after the app was used to spread leaked university exam papers. CEO Pavel Durov accused Indian telecom Reliance of BGP hijacking that disrupted the app in the UAE as well — a country that had nothing to do with the original order. The ban is in effect until June 22. It highlights how aggressively governments are willing to act against encrypted platforms, and how those actions can spill across borders.
Source: BleepingComputerAttackers are scanning for Joomla websites that use the JCE (Joomla Content Editor) plugin and exploiting a critical flaw to upload malicious code — no login required. The attacks are automated, meaning even sites without public user registration are at risk. CISA ordered all U.S. federal agencies to patch by today, Friday. If you or your organization runs a Joomla website with the JCE plugin installed, update to JCE Pro 2.9.99.6 immediately. If you were hit before updating, the patch closes the door but does not clean out what the attacker already planted — run a full malware scan and rotate all passwords after patching.
What you can do: Log into your Joomla admin panel, check your JCE plugin version, and update it right now. Then check for any unfamiliar editor profiles under the JCE settings — those may be signs of a prior compromise.
Source: BleepingComputerINC ransomware has now claimed 830+ victims since August 2023, with more than 65% in the United States. Legal services, manufacturing, construction, and healthcare are the most targeted sectors. The group has rewritten its attack software in Rust — a programming language that makes the malware harder to reverse-engineer and easier to run on both Windows and Linux servers. Researchers at Acronis say INC expanded rapidly after competing groups LockBit and BlackCat were disrupted, picking up their affiliates.
What you can do: Ensure all servers — especially backup and virtualization servers — use strong, unique passwords and have MFA enabled. INC specifically targets Veeam backup systems as part of its attacks.
Source: The Hacker NewsA race condition in Microsoft's built-in antivirus engine (Defender) lets an attacker gain full control over a Windows computer — full SYSTEM-level access, the highest possible. Known as "RoguePlanet," the flaw was publicly demonstrated by a researcher last week. On some machines, the attack has a near-100% success rate.
Patch status: No patch yet. Microsoft confirmed it is working on a fix but has not given a release date. There is currently no workaround. Keep watching for Windows updates this coming week.
A memory flaw in NGINX's HTTP/3 module lets an unauthenticated attacker on the internet trigger remote code execution on web servers. NGINX is one of the most widely deployed web server platforms in the world — it powers a significant chunk of the internet.
Patch status: F5 released out-of-band security updates on June 18. If you run NGINX, update immediately. This is classified critical and affects systems using the HTTP/3 QUIC module.
This is the flaw discussed in the Active Attacks section above. It allows anyone without a login to upload and run PHP code on Joomla websites — the highest possible severity score. Working exploit code is public and attacks are already automated.
Patch status: Fixed in JCE Pro 2.9.99.6. Update immediately. If your site was already compromised, the patch alone is not enough — investigate and clean the site.
Hudson Rock, the threat intelligence firm that analyzed the FortiBleed dataset, released a free lookup tool at hudsonrock.com/fortinet that lets organizations check whether their domain or IP address appears in the leaked Fortinet credential database. This is the kind of tool that matters right now: the breach is confirmed, the data is real, and companies need a fast way to assess exposure without trawling through raw datasets themselves. If you're an IT administrator or work at a company that uses Fortinet firewalls for remote access, checking this lookup should be your first move today. Free, no account required, and takes about thirty seconds.
When security teams catch an attacker, the instinct is to shut down the attacker's infrastructure — take the server offline, block the IP. That's supposed to end the intrusion. A case study published this week by Cato Networks shows why that's often wrong.
The attacker, tracked by researchers under the alias "Poisson," broke into a small French automotive business sometime in March. He planted a keylogger, stole banking logins and email passwords, and generally made a mess. Standard stuff. But 27 days in, before his control server went offline, he installed two widely trusted tools — OpenSSH (a legitimate remote-access program common on servers) and Tailscale (a VPN-like networking tool used by thousands of businesses) — on the victim's machine. Then he connected that machine to his own private network.
The next day, his original server went dark. Maybe it was taken down, maybe he just forgot to pay the bill. Doesn't matter. He still had access. The SSH and Tailscale connections were still alive, running over encrypted channels that looked like routine business software to any firewall watching.
Eighteen days later, his original server came back online. His malware reconnected automatically. He picked up where he left off, running 145 more commands over five days before going quiet on May 1.
Researchers know all of this not because they were watching in real time, but because Poisson accidentally left his own tools exposed on a public storage server — his SSH keys, his step-by-step playbook, even a test file where he'd typed his own keystrokes over and over while testing the software. Security is hard for everyone, including attackers.
What makes this case worth reading is the lesson embedded in it. Poisson is not sophisticated. He missed half his attempts, triggered Windows prompts that required a human to click "Yes," and left his name on his storage buckets. He compromised four machines anyway, and he stayed in for over a month even after his control infrastructure supposedly went down.
The reason: defenders killed the C2 server, not the access. They're different things. When you find an attacker's command server and take it offline, that ends the conversation — but it doesn't remove the doors the attacker already unlocked. SSH servers, scheduled tasks, remote-access tools — these can all outlive the original malware and let the attacker walk back in quietly.
The fix is forensic, not reactive. When you find evidence of a breach, assume the attacker has more than one way in. Hunt for installed software that shouldn't be there (SSH server on a Windows workstation is a red flag). Check scheduled tasks set to run at login with highest privileges. Look for remote networking tools like Tailscale or Ngrok. The C2 is one door. Find the others before you lock just that one and declare the incident closed.