FortiBleed Exposes 73,000 Firewalls — And a NATO Contractor
Tuesday, June 23, 2026 · 5-minute read
A massive operation dubbed "FortiBleed" has exposed working credentials for 73,932 Fortinet VPN firewall URLs across 194 countries — including Chevron, Samsung, Comcast, Siemens, and government agencies. A Russian-speaking group ran roughly 1.16 billion login attempts, cracked intercepted password hashes with a 45-GPU cluster, and used the results to break into internal networks. A NATO defense contractor in Turkey reportedly had classified documents stolen.
↗ BleepingComputerCanada's spy service (CSIS) obtained a court warrant to reach into home routers, Ring doorbells, security cameras, and smart TVs sitting on Canadian soil — and neutralize two foreign-run botnets. It's the first time CSIS has used its "threat reduction" powers this way. The warrant, granted in May 2024 but only made public this month, let agents alter or destroy malware data on privately owned devices without the owners' knowledge.
↗ The Hacker NewsA new INTERPOL report finds phishing is now the most widespread cybercrime across Asia and the South Pacific, with a third of countries in the region logging more than 10,000 cases in a 15-month period. Criminal networks are using AI to run social engineering attacks at industrial scale. Over half of INTERPOL member countries say cybercrime now accounts for at least 30% of all recorded crime nationally.
↗ The Hacker NewsThe FortiBleed campaign isn't just historical data — security researcher Kevin Beaumont confirmed that almost all 75,000 affected Fortinet devices are still online, most with their management interfaces directly exposed to the internet. Attackers already used cracked credentials to move laterally into Active Directory environments at multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey. CISA has separately warned Fortinet users to lock down their devices immediately.
↗ BleepingComputer / CISAAttackers compromised ShapedPlugin's software build pipeline and pushed backdoored updates to paying customers of three WooCommerce plugins. The malicious update installs a hidden fake plugin that steals admin passwords in plaintext, captures two-factor authentication codes, and drops a web shell for persistent access. It also exports your entire database configuration, all admin account info, and three months of WooCommerce order data before erasing itself.
Patch available: Yes — update to Product Slider Pro 3.5.4+, Smart Post Show Pro 4.0.2+, and avoid Real Testimonials Pro 3.2.5. Reset all passwords and revoke MFA secrets if you ran any affected version.
A critical flaw in Splunk Enterprise (versions 10.0.0–10.0.6 and 10.2.0–10.2.3) lets any attacker on the network create or overwrite files on the server without logging in — no password required. Security firm WatchTowr published working proof-of-concept exploit code, and CISA confirmed active attacks in the wild. U.S. federal agencies were ordered to patch by Sunday, June 22.
Patch available: Yes — upgrade to Splunk Enterprise 10.0.7 or 10.2.4+. If you can't patch immediately, disable the PostgreSQL sidecar service as a temporary workaround (note: this breaks some data pipeline features).
Named after Heartbleed, Squidbleed is a 29-year-old memory leak bug in the Squid web proxy — software used by schools, offices, and public Wi-Fi networks to manage internet traffic. Another user on the same network can trick Squid into leaking a different user's HTTP request, including any passwords or session tokens it contains. The flaw traces back to a 1997 code change and still ships in Squid's default config.
Patch status: Researchers at Calif.io disclosed this in June 2026. Check your Squid version and apply available updates. If you're on a shared network (coffee shop, school, office), this is a reminder not to use plain HTTP for anything sensitive.
Canada's intelligence service just demonstrated something genuinely new: using a court-issued "threat reduction warrant" to remotely clean malware from privately owned routers, cameras, and smart home devices — without contacting the owners first. CSIS was permitted to alter, degrade, and destroy botnet data on infected machines on Canadian soil. Until now, law enforcement could seize servers or arrest people, but cleaning infected devices at scale required impractical outreach to millions of individual users. This warrant-based approach could become a template for other countries trying to dismantle botnets made up of home devices — arguably the hardest category to clean up because the owners rarely know they're infected. The court published a redacted ruling this month after keeping it confidential for two years.
Imagine a locksmith who methodically tries every key combination on every lock in a city — except instead of a city, it's every Fortinet firewall on the internet, and instead of a locksmith's bag, they're running a 45-GPU computing cluster that can crack passwords around the clock. That's essentially what the FortiBleed attackers pulled off over the past several months.
The story broke when security researcher Bob Diachenko found an exposed server belonging to what appears to be a Russian-speaking criminal group. The server wasn't just storing stolen credentials — it had been left partially open, leaking the crew's own tooling, scripts, logs, and analytics. Diachenko described it as finding a burglar's workshop with the door ajar.
What was inside: credentials for 73,932 Fortinet firewall URLs spanning 194 countries. The group had attempted roughly 1.16 billion logins against FortiGate SSL VPN devices and another 2.1 billion against Microsoft SQL Servers. When passwords were hashed (scrambled by the firewall), the attackers intercepted the scrambled versions and ran them through a GPU cracking rig until they recovered the originals.
The affected list reads like a Fortune 500 roll call: Chevron, Samsung, Foxconn, Comcast, Siemens, Lenovo, PwC, Accenture, Oracle. Also on the list: government agencies, healthcare providers, and critical infrastructure operators across nearly every major industry. Most troublingly, the attackers kept detailed notes on each target — recording the company's industry, revenue, and employee count. This wasn't random. They were planning who to hit next.
Independent researcher Kevin Beaumont reviewed portions of the data and confirmed the credentials are real. He also found something alarming: almost all of those 73,000-plus devices are still online right now, with their management interfaces directly exposed to the internet. That's roughly half of all internet-facing Fortinet firewalls. The attackers already used their access to move deeper into at least several organizations — one of them a Turkish NATO defense contractor from which classified documents were reportedly stolen.
Here's what makes FortiBleed especially dangerous: the source of the original data still isn't clear. Nobody has pinpointed a specific Fortinet vulnerability that was exploited. The credentials may have come from exported configuration files, previously known flaws, or something new. Fortinet hasn't commented. Until that question is answered, there's no clean technical fix — just the manual work of rotating passwords, enabling MFA, and auditing who's been inside your network. Hudson Rock has published a free lookup tool at hudsonrock.com/fortinet. If your organization uses Fortinet products, checking it takes about 30 seconds.