Fortinet has found a new TrickBot variant hiding commands in DNS traffic and using scheduled tasks and added modules to maintain access on infected Windows PCs.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog.
CVE-2026-25089 (CVSS score of 9.8) Fortinet FortiSandbox OS Command Injection Vulnerability
CVE-2026-39808 (CVSS score of 9.8) Fortinet FortiSandbox OS Command Injection Vulnerability
CVE-2026-58644 (CVSS score of 9.8) Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
This week, Microsoft’s July 2026 Patch Tuesday addressed the SharePoint remote code execution bug CVE-2026-58644, which can be triggered without authentication or user interaction. The flaw stems from the deserialization of untrusted data.
“Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.” reads the advisory. “In a network-based attack, an attacker authenticated as at least a Site Owner, could write arbitrary code to inject and execute code remotely on the SharePoint Server.”
Microsoft confirmed it is aware of active exploitation of this vulnerability.
The second issue added to the KeV catalog is an OS command injection flaw, tracked as CVE-2026-25089, in FortiSandbox products. The vulnerability could allow remote, unauthenticated attackers to send specially crafted HTTP requests and execute arbitrary commands on affected devices. Adham El Karn of Fortinet Product Security team discovered the vulnerability.
The last issue added to the catalog, tracked as CVE-2026-39808, is an OS command injection flaw.
“An Improper Neutralization of Special Elements used in an OS Command (‘OS command injection’) vulnerability [CWE-78] in FortiSandbox may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.” reads the advisory.
Cybersecurity firm Defused Cyber confirmed it’s seen active exploitation of this vulnerability within a 24-hour window.
Note The June 2026 Dark Web Breach Incident Trend Report is based on major data breach cases posted on the deep web and dark web forums. Due to the nature of some sources, it was difficult to fully verify the accuracy of certain information, so the report includes content that requires further verification. Major Issue […]
FortiBleed, the Fortinet credential theft campaign, is now connected to INC Ransom and Lynx, with a Nextcloud zero-day vulnerability also under investigation.
Polymarket has built an entire business on predicting the future. So how did it manage to spectacularly fail to predict its own hack? Plus, the Google engineer with a million-dollar secret, and the curious case of the airport hairdryer.
Meanwhile, "FortiBleed" sees 75,000 Fortinet firewalls thrown wide open - and the real damage is going to roll on for years.
All this and more in episode 474 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Quentyn Taylor.
FortiBleed exposed valid credentials for 73,000+ Fortinet firewalls, revealing a large-scale access-brokering operation targeting organizations worldwide.
In mid-June 2026, researcher Volodymyr “Bob” Diachenko found a live, exposed server containing working login credentials for tens of thousands of Fortinet firewalls, a data leak code-named FortiBleed. The headline number, valid remote-access logins for 73,932 devices across 21,632 organizations in 194 countries, roughly half of every internet-facing FortiGate on the planet, is what made it news. The server was left open by accident, complete with the tools, logs, scripts, and credential catalog of a running operation.
But a list of stolen passwords is the output of a crime, not the crime itself. Mysterium VPN traced the operation back to a single vendor trading under the handle “SantaAd” on an underground Russian-speaking cybercrime forum.
The account has been building a vendor reputation since early 2025, and its post history reads like a product catalog with one obsession: Fortinet. Over recent months, the same seller auctioned remote-access credentials to named US manufacturers, listed thousands of Fortinet admin panels, and ran a standing advertisement buying fresh corporate access from US companies above a set revenue threshold.
“The single most telling piece of evidence in the whole affair isn’t a password; it’s the spreadsheet.” reads the report published by MysteriumVPN “The leaked data is annotated, organization by organization, with company name, sector, annual revenue, and employee count, and sorted into tiers by how much they’re worth.”
Espionage actors sort targets by intelligence value. This actor sorted them by price. The revenue column is what marks this as a financially motivated operation whose end product is resale — most likely to ransomware crews for whom a pre-validated foothold in a high-revenue company is exactly what they’re buying.
The operation ran on mostly off-the-shelf parts. A dedicated brute-force server generated and tested credential combinations at scale — over a billion device-and-password pairs drawn from a few thousand common starting points, running tens of thousands of simultaneous attempts through rotating proxy addresses. A separate cracking server ran an open-source password-cracking tool fed by a cluster of roughly 45 high-end GPUs rented by the hour. A third workstation handled manual work: writing code, managing seven disposable Kali Linux virtual machines, and navigating victim networks once access was established.
“The custom code carries the fingerprints of machine-generated software — emoji status messages, tidy ‘Step 1 / Step 2 / Step 3’ formatting, verbose explanatory comments, and ties back to an AI code-editor session created days before the campaign began.” continues the report.
The crew also deployed an AI-driven penetration-testing framework: a tool that lets an operator describe an objective in plain language and have software carry out the network attack automatically. Actions that once required a skilled, experienced attacker are now available to anyone who can rent a server and formulate a prompt.
The broker’s own candor is instructive. In one auction thread, when asked where the data came from, the seller said it was “mostly brute” and that the brute-forcing tool was written in-house. When asked how many credentials actually worked, they admitted that only a fraction had been confirmed valid and that the validation tool had broken. At one point an entire auction was pulled because “the dump had errors.” This is what access brokering looks like from the inside: a noisy, imperfect assembly line, not a clean heist.
“When this made the news, the broker didn’t go quiet. They updated a live auction for access to several thousand Fortinet devices, raised the starting price, and cited the news coverage as an authenticity guarantee.” A journalist’s writeup used as a sales testimonial. That’s a first.
The practical takeaway is architectural. The device organizations buy to keep strangers out became the front door a criminal crew walked through and then cataloged. Get the management interface off the public internet, enforce multi-factor authentication on VPN and admin access, some of the cracked credentials in this dataset were long and complex, which proves password strength alone doesn’t save you, and rotate every credential stored in the device configuration. Then assume your organization is already on a shopping list, because if it could appear in this dataset, access to your network may already be for sale.
FortiBleed targeted 430,000+ FortiGate devices, harvesting 110M credentials and enabling breaches through large-scale credential theft.
A new threat intelligence report from SOCRadar’s Threat Research Unit (STRU), the team that first identified and named the FortiBleed campaign, goes deeper than anything published so far on what is shaping up to be one of the most significant credential-theft operations of 2026.
FortiBleed is a large-scale, financially motivated campaign targeting FortiGate firewalls globally. STRU first reported and named the campaign here. The numbers alone are staggering: over 430,000 FortiGate firewalls targeted, more than 110 million credentials identified across 659+ harvesting pipelines, and a confirmed breach of a NATO-aligned defense contractor.
What makes this report different
Most coverage of FortiBleed stops at the headline figures. This report doesn’t.
Starting from a single exposed directory flagged by security researcher Volodymyr “Bob” Diachenko, STRU traced the operation to more than 150 additional servers, building a near-complete picture of the actor’s infrastructure, tooling, and operational workflow. At the time of writing, the campaign is still actively sniffing over 19,000 devices, part of a broader pool of 80,553 identified targets.
That level of visibility is what separates this analysis from others.
A five-phase attack chain, fully reconstructed
The report walks through every stage of the operation in technical detail:
The actor starts with credential sourcing and mass reconnaissance, using Masscan for port sweeps, a custom Shodan_Recon tool for passive enrichment, and a purpose-built FortiProbe-fast binary to filter confirmed FortiGate devices from millions of raw scan results. Targets are then ranked by revenue before any exploitation resources are allocated, a step that reflects deliberate operational planning rather than opportunistic spraying.
Initial access comes through SSH brute-force using 16 wordlists specifically curated for FortiGate admin account naming conventions, alongside credential stuffing against SSL-VPN portals.
The core of the operation is a Golang-based tool called FortigateSniffer, which abuses the legitimate FortiOS diagnostic command diagnose sniffer packet to passively capture authentication traffic across 24 protocols from every compromised device, Kerberos, RADIUS, NTLM, RDP, LDAP, MSSQL, and more, without deploying any malware. The sniffer only runs between 07:00 and 18:00 Moscow Time, a deliberate evasion choice to blend in with normal business-hours traffic.
Captured hashes are cracked through a distributed GPU cluster managed via Hashtopolis, with Hashcat as the underlying engine and a Telegram bot providing live telemetry to a single hardcoded administrator. The actors also rented GPU capacity through vast.ai for additional cracking power.
The final phases cover lateral movement across Active Directory environments and, in at least one confirmed case, the targeted exfiltration of DFS backup data from a NATO-aligned defense contractor, triggered within minutes of Kerberos hashes being cracked offline.
Infrastructure and attribution
The actors operate from a network of loosely regulated Eastern European micro-hosters, with the core infrastructure segmented across four subnet blocks serving distinct roles: C2 aggregation, credential validation, sniffer deployment, and proxy rotation. The pentest lab environment itself runs seven Kali Linux virtual machines under QEMU/KVM, hardened with strict IPTables rules and designed for multi-operator remote access through shared tmux sessions.
Tooling comments in the Cyrillic alphabet suggest Russian origin. The actor profile is consistent with an Initial Access Broker selling access to ransomware groups, though the targeting of a NATO-aligned defense contractor raises the possibility of at least opportunistic collaboration with state-adjacent actors.
Who is being hit
The victim profile skews heavily toward SMBs: roughly 66% of affected organizations have fewer than 200 employees, and nearly 90% have annual revenues below $100 million. India, the United States, and Taiwan account for nearly a third of affected domains. IT services is the most targeted sector, a strategic choice, since compromising a managed service provider creates downstream access paths into customer environments.
The campaign is global and appears opportunistic rather than geopolitically focused, with meaningful victim counts across Latin America, the Middle East, and Europe as well.
What to do now
STRU recommends that organizations potentially in scope immediately rotate all credentials tied to Fortinet VPN and administrative interfaces, enforce MFA, remove FortiGate management interfaces from direct internet exposure, and review authentication logs for anomalous activity. SOCRadar has also released a free FortiBleed exposure checker at socradar.io/free-tools/fortibleed.
The campaign remains active. The full technical report, including the complete MITRE ATT&CK mapping, IoC lists, and infrastructure breakdown, is at socradar.io.
FortiBleed exposed a massive campaign that made billions of login attempts against Fortinet VPNs, compromising organizations worldwide.
FortiBleed wasn’t a targeted hack. It was a factory. A multi-operator crew ran an industrial-scale attack against Fortinet FortiGate SSL VPN devices worldwide, and security researcher Volodymyr “Bob” Diachenko of SecurityDiscovery.com caught them only because they left their own infrastructure exposed on the open internet in June 2026.
“The crew mass-scans 320,777 FortiGate /remote/login endpoints and more than 247,000 Sophos /userportal endpoints. FortiGate logins are then sprayed with 3,639 base credential pairs across every target, 1.16 billion combinations in total, through a custom tool called forticheck running 25,000 threads.” reads the report published by Ransomnews.
A parallel campaign hit 163,650 MSSQL servers with 2.1 billion attempts at 50,000 threads. That’s not espionage; that’s automation.
Once they got in somewhere useful, they dropped network sniffers to pull cleartext credentials from HTTP, FTP, SMTP, LDAP, and other protocols.
“Once inside reachable infrastructure, the operators drop network sniffers that scrape cleartext credentials out of HTTP, FTP, SMTP, POP3, IMAP, LDAP, SNMP, and Telnet traffic.” states the report. “Intercepted Kerberos and NTLM hashes are shipped to a 45-way NVIDIA RTX 4090 cracking cluster orchestrated through Hashtopolis.”
With cracked credentials in hand, they replayed captured session cookies through OpenConnect to hijack live VPN sessions, then walked straight into Active Directory. Standard looting from there: AD dumps, fileshare exfiltration, Kerberos tickets, Group Policy templates.
The operators aren’t random. They work from Kali Linux virtual machines behind NAT so their command server never touches a victim’s Active Directory directly. Targets are ranked by revenue, with a top tier above 113 billion dollars, using open-source intelligence. Multiple operators work the same machines at once, coordinating over shared terminal sessions. The hash-cracking server, tellingly, was left running on default credentials. The same mistake they exploit in victims.
At least four organisations were fully compromised, across Japan, Taiwan, Vietnam, Iraq, and Turkey. The most serious claim involves a Turkish defence contractor with NATO ties whose classified defence documents were exfiltrated. Ransomnews hasn’t independently verified those contents and treats the attribution as the investigator’s assessment, not confirmed fact.
The working dataset covers 73,932 exposed FortiGate devices across 21,613 organisations in 207 countries. India leads on raw volume, and Latin American telecoms carry the densest device fleets. IT services, telecoms, financial services, and government are the most exposed sectors.
“In a random sample of exposed organisations, 88% also appeared in stealer-log or breach data and 38% had staff with active infostealer infections. Around 590 are already named on ransomware leak sites.” concludes the report.”An exposed FortiGate is rarely an isolated problem. It is one visible symptom of an organisation attackers have already found more than once.”
An exposed FortiGate isn’t a standalone problem. It’s a sign that attackers have already found the organisation more than once.
If you run FortiGate, take the management interface and SSL VPN off the public internet wherever possible. Rotate every administrator and local credential, upgrade FortiOS, and invalidate active VPN sessions so replayed cookies stop working. Reset exposed employee credentials too, not just the firewall accounts, because the infostealer overlap is too high to ignore.
The researchers also released a FortiBleed Checker to allow admins to check their domains.
FortiBleed exposed credentials for 74,000 Fortinet devices, with attackers actively exploiting the leak to target systems worldwide.
On June 18, CISA issued an emergency alert after reports surfaced that credentials for approximately 74,000 Fortinet firewalls and VPN gateways had been leaked in what researchers are calling FortiBleed. The agency confirmed that threat actors were actively using those credentials to target internet-accessible Fortinet devices across government and private-sector organizations worldwide.
“CISA is aware of global reports that malicious cyber actors have targeted internet-accessible Fortinet devices across government and private sector organizations using compromised credentials.” reads the alert published by CISA. “This activity, referred to as FortiBleed, involves the exposure of leaked credentials associated with approximately 74,000 Fortinet devices, including firewalls and virtual private network (VPN) gateways.”
This week, the security researcher Bob Diachenko found a server sitting open on the internet containing what appeared to be valid Fortinet VPN credentials, including usernames, email addresses, and plaintext passwords for tens of thousands of organizations. He posted about it on LinkedIn. Kevin Beaumont, one of the most trusted independent voices in network security, then obtained the dataset, worked through it with Hudson Rock, and confirmed what nobody wanted to hear.
“Massive Fortinet/FortiGate bruteforce/active exploitation campaign uncovered in action. Thousands of top vendors instances are listed in the files like this (see screenshot). This one alone has 21,634 domain names – from Chevron to Fortinet itself. All – with potentially working passwords to the FortiGate appliances obtained through various menas.” Bob Diachenko wrote on LinkedIn. “Crooks use sophisticated hashcracking approach to get then plaintext passwords from the Fortigate configs and use them consequently in the internal network movement and takeover.”
The popular cybersecurity expert Kevin Beaumont confirmed that the data is legit and is related to around 75k devices.
“The data is legit. It is around 75k devices. Almost all are still online, and Fortinet devices. It appears to be recent data.” reads the analysis published by Beaumont. “The data appears to have come from exports of config from the devices, as it includes things which are only visible from the device itself.”
Beaumont verified credentials at multiple organizations in the dataset personally and found them working. The IP addresses in this collection are largely different from the 2025 Belsen Group leak, which covered 15,000 devices. That earlier dump was old data from a 2022 zero-day. This one isn’t.
Based on Shodan polling, the FortiBleed dataset covers roughly 50% of all Fortinet firewall devices currently facing the internet.
“In a majority of cases, the Fortigate Management Interface is exposed to the internet on impacted devices.” states the expert.
According to Hudson Rock’s analysis, the 73,932 unique firewall URLs span 194 countries and 21,632 unique domains. Names appearing in the dataset according to Hudson Rock include Foxconn, Samsung, Comcast, Siemens, Lenovo, PwC, Accenture, Oracle, and numerous government agencies and critical infrastructure operators. One entry in Diachenko’s screenshots alone listed 21,634 domain names, including Chevron and Fortinet itself.
Diachenko’s investigation went further after he found the attackers had accidentally left an open directory containing their own tooling, scripts, connection strings, logs, and analytics. What he found inside suggests a Russian-speaking multi-operator threat group conducted approximately 1.16 billion credential attempts against 320,777 FortiGate targets, plus 2.1 billion attempts against 163,650 Microsoft SQL Server systems.
The group reportedly intercepted SSL VPN authentication hashes and cracked them using a 45-GPU cluster managed through Hashtopolis. Multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey were described as fully compromised, including a Turkish NATO defense contractor from which classified documents were allegedly stolen.
The data appears to have come from exported device configurations rather than a simple credential scrape. That’s a meaningful distinction: config exports contain information you can’t get just by intercepting login traffic, which points toward actual device access at some point. How that access was obtained remains unknown: it may be one of the many documented Fortinet CVEs, or it may be something new.
One detail in the dataset that stands out is the business intelligence layer. Each entry includes the company’s industry, revenue, employee count, and country, formatted in a way Beaumont describes as very common in criminal markets for selling initial access. This wasn’t assembled for personal use. It was assembled for sale or coordinated deployment across a team. The attached comments on each target are essentially a sales catalog.
That means an attacker with these credentials can log in remotely, gain access to the firewall and therefore the network behind it, change security settings, and create backdoor admin accounts. Beaumont also noted that Fortinet moved to PBKDF2 credential storage in early 2025 firmware updates, but only for devices where admins had actually logged in after applying the update. Many devices were still storing passwords as SHA-256 with salt, which is crackable via brute force from a stolen config file.
Hudson Rock has published a free lookup tool at hudsonrock.com/fortinet where organizations can check if their domain appears in the dataset.
” It is unclear where Hunt Intelligence obtained the data from and how long it has been in circulation, however it is formatted in a way which looks like an eCrime gang — e.g. it lists the type of company, their revenue and country.” concludes Beaumont. “This is a very common format in eCrime circles when selling initial access information.”
CISA’s instructions are direct and non-negotiable for any organization running Fortinet equipment. Terminate all active SSL VPN and administrative sessions immediately. Reset every VPN and administrative password. Enable phishing-resistant multi-factor authentication on all admin interfaces. Review logs for unauthorized access or lateral movement.
Upgrade to the latest FortiOS release and have every admin log back in to trigger the re-hashing of stored credentials to PBKDF2. Remove the FortiOS management interface from public internet access unless absolutely necessary, and delete any unauthorized accounts.
If you see unexpected successful logins to admin accounts, don’t assume it was a mistake. Assume the device is compromised and consider replacing it, because the attackers may have already modified its configuration or planted backdoor accounts that persist through credential rotation.
FortiBleed: Admin Passwords for 75,000 Fortinet Firewalls Are Out in the Wild. Half the Internet-Facing Fortinets on the Planet.
Security researcher Bob Diachenko found a server sitting open on the internet containing what appeared to be valid Fortinet VPN credentials, including usernames, email addresses, and plaintext passwords for tens of thousands of organizations. He posted about it on LinkedIn. Kevin Beaumont, one of the most trusted independent voices in network security, then obtained the dataset, worked through it with Hudson Rock, and confirmed what nobody wanted to hear.
“Massive Fortinet/FortiGate bruteforce/active exploitation campaign uncovered in action. Thousands of top vendors instances are listed in the files like this (see screenshot). This one alone has 21,634 domain names – from Chevron to Fortinet itself. All – with potentially working passwords to the FortiGate appliances obtained through various menas.” Bob Diachenko wrote on LinkedIn. “Crooks use sophisticated hashcracking approach to get then plaintext passwords from the Fortigate configs and use them consequently in the internal network movement and takeover.”
The popular cybersecurity expert Kevin Beaumont confirmed that the data is legit and is related to around 75k devices.
“The data is legit. It is around 75k devices. Almost all are still online, and Fortinet devices. It appears to be recent data.” reads the analysis published by Beaumont. “The data appears to have come from exports of config from the devices, as it includes things which are only visible from the device itself.”
Beaumont verified credentials at multiple organizations in the dataset personally and found them working. The IP addresses in this collection are largely different from the 2025 Belsen Group leak, which covered 15,000 devices. That earlier dump was old data from a 2022 zero-day. This one isn’t.
Based on Shodan polling, the FortiBleed dataset covers roughly 50% of all Fortinet firewall devices currently facing the internet.
“In a majority of cases, the Fortigate Management Interface is exposed to the internet on impacted devices.” states the expert.
According to Hudson Rock’s analysis, the 73,932 unique firewall URLs span 194 countries and 21,632 unique domains. Names appearing in the dataset according to Hudson Rock include Foxconn, Samsung, Comcast, Siemens, Lenovo, PwC, Accenture, Oracle, and numerous government agencies and critical infrastructure operators. One entry in Diachenko’s screenshots alone listed 21,634 domain names, including Chevron and Fortinet itself.
Diachenko’s investigation went further after he found the attackers had accidentally left an open directory containing their own tooling, scripts, connection strings, logs, and analytics. What he found inside suggests a Russian-speaking multi-operator threat group conducted approximately 1.16 billion credential attempts against 320,777 FortiGate targets, plus 2.1 billion attempts against 163,650 Microsoft SQL Server systems.
The group reportedly intercepted SSL VPN authentication hashes and cracked them using a 45-GPU cluster managed through Hashtopolis. Multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey were described as fully compromised, including a Turkish NATO defense contractor from which classified documents were allegedly stolen.
The data appears to have come from exported device configurations rather than a simple credential scrape. That’s a meaningful distinction: config exports contain information you can’t get just by intercepting login traffic, which points toward actual device access at some point. How that access was obtained remains unknown: it may be one of the many documented Fortinet CVEs, or it may be something new.
One detail in the dataset that stands out is the business intelligence layer. Each entry includes the company’s industry, revenue, employee count, and country, formatted in a way Beaumont describes as very common in criminal markets for selling initial access. This wasn’t assembled for personal use. It was assembled for sale or coordinated deployment across a team. The attached comments on each target are essentially a sales catalog.
That means an attacker with these credentials can log in remotely, gain access to the firewall and therefore the network behind it, change security settings, and create backdoor admin accounts. Beaumont also noted that Fortinet moved to PBKDF2 credential storage in early 2025 firmware updates, but only for devices where admins had actually logged in after applying the update. Many devices were still storing passwords as SHA-256 with salt, which is crackable via brute force from a stolen config file.
Hudson Rock has published a free lookup tool at hudsonrock.com/fortinet where organizations can check if their domain appears in the dataset.
” It is unclear where Hunt Intelligence obtained the data from and how long it has been in circulation, however it is formatted in a way which looks like an eCrime gang — e.g. it lists the type of company, their revenue and country.” concludes Beaumont. “This is a very common format in eCrime circles when selling initial access information.”
For any organization that finds itself in the data: rotate admin credentials immediately, check for unexpected successful logins to admin accounts, upgrade to the latest FortiOS and have admins log back in to trigger the credential storage upgrade, disable internet-facing management interfaces, and enforce multi-factor authentication on all admin users.
Researchers say FortiBleed used stolen and tested credentials to access exposed Fortinet firewalls, putting major organizations and public agencies at risk now.
Three FortiSandbox flaws, including one patched last week, are being actively exploited, highlighting the shrinking window for defenders.
Cybersecurity firm Defused Cyber confirmed it’s seen active exploitation of three vulnerabilities in Fortinet FortiSandbox within a 24-hour window. Two of them had patches sitting available since April. The third got fixed last week, which, apparently, wasn’t fast enough.
We are observing exploitation of multiple Fortinet FortiSandbox vulnerabilities during the past 24 hours, including:
CVE-2026-39813 (no previous recorded exploitation) CVE-2026-39808 CVE-2026-25089 (vibecoded, likely faulty exploit)
CVE-2026-39813 (CVSS score: 9.1) is a path traversal vulnerability in FortiSandbox JRPC API that could allow an unauthenticated attacker to bypass authentication via specially crafted HTTP requests. Its twin, CVE-2026-39808 (CVSS score of 9.8), carries the same severity score and is an OS command injection flaw, same attack vector, same result: unauthenticated code execution via crafted HTTP requests. Both had patches available for two months.
The third flaw, CVE-2026-25089, hits a broader surface. Fortinet described it as an operating system command injection impacting FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI that could allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. The patch dropped last week, yet it’s already being used in the wild.
“An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.” reads the advisory.
Here’s where it gets interesting. The exploit for CVE-2026-25089 appears to have been built with AI assistance, and it shows, not in a good way. Defused Cyber researchers speculate that the exploit for CVE-2026-25089 not only shows signs of being developed using an artificial intelligence (AI) model, but is also bugged. A working exploit for the vulnerability has not been publicly disclosed. So attackers are throwing broken AI-generated code at unpatched systems and still finding traction. That should tell you something about the state of patch management out there.
Fortinet gear keeps drawing this kind of attention. In April, the company pushed out-of-band patches for a critical flaw in FortiClient EMS, tracked as CVE-2026-35616, (CVSS score of 9.1) which was already being exploited before the fix arrived. If you run anything in the Fortinet stack, the window between disclosure and active exploitation has become uncomfortably short. Patch cycles measured in weeks are now measured in days.
A expectativa sobre a Copa do Mundo de 2026 vem sendo amplamente explorada por cibercriminosos em escala global. Levantamento realizado pelo FortiGuard Labs, laboratório de inteligência da Fortinet, identificou mais de 13 mil domínios registrados com referências ao torneio entre janeiro e maio deste ano. Desse universo, cerca de 1.140 endereços (o equivalente a 8,8%) foram classificados como maliciosos ou suspeitos, evidenciando o uso crescente do maior evento do futebol mundial como isca para fraudes digitais.
De acordo com a análise, a infraestrutura criada pelos criminosos sustenta campanhas organizadas voltadas à aplicação de golpes financeiros e ao roubo de informações sensíveis. Entre as principais ameaças observadas estão páginas falsas para venda de ingressos, inclusive por meio de canais como o Telegram; lojas virtuais fraudulentas de produtos oficiais; plataformas ilegítimas de transmissão de partidas; campanhas de phishing e falsas oportunidades de emprego relacionadas ao evento.
Nos dois meses que antecederam a competição, foi identificado um crescimento expressivo no registro de novos domínios ligados à Copa do Mundo, acompanhando o movimento do mercado e dos países na ampliação das ações direcionadas ao evento e aumento do interesse do público. O levantamento apontou que mais de 270 mil credenciais de usuários/fãs que visitaram sites relacionados à FIFA foram identificadas em registros de roubo de dados baseados em delimitadores.
Contas falsas em redes sociais Outro destaque do levantamento é a proliferação de perfis falsos em redes sociais. Mais de 1.700 contas e canais que utilizam indevidamente a identidade visual e a marca da FIFA foram identificados em plataformas digitais, especialmente Facebook e Instagram:
Instagram – 60,27%
Facebook – 28,94%
X (antigo Twitter) – 8,16%
Telegram – 1,66%
Youtube – 0,97%
“Esses ambientes são utilizados para disseminar promoções inexistentes, páginas de phishing, sorteios falsos e outras estratégias de engenharia social destinadas a enganar torcedores. Os pesquisadores também utilizaram a circulação de aplicativos maliciosos que simulam serviços de apostas esportivas, streaming de partidas e acompanhamento de resultados. Distribuídos por sites não oficiais e canais de mensagens, esses aplicativos podem instalar malwares capazes de roubar credenciais, capturar dados financeiros e comprometer os dispositivos das vítimas”, aponta Alexandre Bonatti, vice-presidente de Engenharia da Fortinet Brasil.
A comercialização fraudulenta de ingressos aparece entre os golpes mais recorrentes. Criminosos criam páginas praticamente idênticas às oficiais para convencer consumidores a realizar pagamentos ou fornecer dados pessoais e bancários. Em muitos casos, a sensação de urgência e a escassez de ingressos são utilizadas para induzir decisões rápidas e reduzir a desconfiança dos usuários.
As falsas lojas de produtos licenciados também ganharam espaço nas campanhas identificadas pelo FortiGuard Labs. Bonatti comenta que os cibercriminosos têm aproveitado o interesse por camisas, itens colecionáveis e produtos exclusivos da Copa do Mundo para comercializar mercadorias inexistentes ou falsificadas, a partir de ambientes que replicam o visual de marcas conhecidas.
“Outra modalidade em crescimento envolve vagas de trabalho temporárias ligadas ao torneio. Mensagens distribuídas por redes sociais, aplicativos de conversa e e-mails direcionam candidatos para páginas falsas de recrutamento que simulam processos seletivos legítimos e capturam credenciais de acesso e informações pessoais”, acrescenta o executivo.
Além das fraudes voltadas aos consumidores, a Fortinet alerta para a necessidade de empresas e organizações envolvidas no evento e parceiros comerciais reforçarem seus mecanismos de proteção. O monitoramento contínuo de domínios semelhantes às marcas, a adoção de autenticação multifator, a atualização constante dos sistemas e o compartilhamento de inteligência sobre ameaças são medidas essenciais para reduzir riscos durante todo o ciclo da competição.
Como consumidores podem se proteger
Conferir cuidadosamente o endereço do site antes de realizar qualquer compra ou informar dados pessoais;
Priorizar a aquisição de ingressos e produtos em canais oficiais ou parceiros autorizados;
Desconfiar de ofertas com descontos muito acima do mercado ou com prazo extremamente limitado;
Evitar downloads de aplicativos e plataformas de streaming provenientes de fontes não oficiais;
Utilizar autenticação multifator em contas digitais sempre que possível;
Acompanhar regularmente movimentações bancárias e notificações de cartões para identificar operações suspeitas.
Recomendações para empresas
Para fortalecer a proteção contra ameaças cibernéticas durante a Copa do Mundo, a Fortinet recomenda que as empresas adotem uma estratégia integrada de segurança. Entre as principais medidas estão o monitoramento contínuo de domínios que possam explorar indevidamente suas marcas, a implementação de soluções avançadas para detecção de phishing e fraudes digitais, além da manutenção permanente de plataformas, aplicações e integrações atualizadas.
A companhia também destaca a importância de reforçar políticas de autenticação multifator para contas críticas e administrativas, promover ações de conscientização voltadas a colaboradores, parceiros e clientes sobre os golpes mais comuns relacionados ao torneio e estabelecer processos integrados de resposta a incidentes, garantindo uma atuação rápida diante de tentativas de fraude ou comprometimento de credenciais.
Sobre a Fortinet A Fortinet (NASDAQ: FTNT) é uma força motriz na evolução da segurança cibernética e na convergência de rede e segurança. Nossa missão é proteger pessoas, dispositivos e dados em todos os lugares, e hoje oferecemos segurança cibernética onde você precisar com o maior portfólio integrado de mais de 50 produtos de nível empresarial. Mais de meio milhão de clientes confiam nas soluções da Fortinet, que estão entre as mais implantadas, mais patenteadas e mais validadas do setor. O Fortinet Training Institute, um dos maiores e mais amplos programas de treinamento do setor, dedica-se a disponibilizar treinamento em segurança cibernética e novas oportunidades de carreira para todos. O FortiGuard Labs, laboratório de pesquisa e inteligência de ameaças de elite da Fortinet, desenvolve e utiliza aprendizado de máquina de ponta e tecnologias de IA para fornecer aos clientes inteligência de ameaças acionável e proteção oportuna e consistente com a melhor classificação do mercado. Saiba mais em www.fortinet.com/br, Fortinet Blog e FortiGuard Labs.
A instabilidade no cenário internacional impulsionou 66% das organizações globais a reestruturarem suas defesas digitais em resposta à volatilidade geopolítica. Os dados são do estudo Global Cybersecurity Outlook 2026, realizado pelo Fórum Econômico Mundial em parceria com a Accenture e líderes do setor, que destaca ainda que 94% dos líderes entrevistados identificam a IA como a principal força a remodelar o risco cibernético no próximo ano, elevando o potencial de ataques voltados à espionagem e à interrupção de infraestruturas críticas.
Embora a influência geopolítica nas decisões de segurança digital apresente oscilações, o tema permanece central na agenda estratégica. Na prática, esse cenário acelera a necessidade de integrar a cibersegurança às decisões de infraestrutura e continuidade operacional, especialmente em setores críticos e altamente digitalizados.
Para Rafael Dantas, Head de Cibersegurança da TLD, empresa brasileira especializada em tecnologia, a digitalização acelerada, especialmente no setor público, trouxe ganhos expressivos de eficiência, mas também reforça a necessidade de reforçar a segurança para possíveis ataques em sistemas e dados estratégicos. “A cibersegurança não pode mais ser vista apenas como um suporte técnico; ela deve integrar a arquitetura das infraestruturas tecnológicas para assegurar a continuidade de serviços essenciais e a soberania digital das instituições”, comenta.
Nesse contexto, falhas de proteção podem gerar impactos sistêmicos, desde a interrupção de serviços públicos essenciais até o vazamento de dados sensíveis de milhões de cidadãos. Especialistas reforçam que a salvaguarda dessas estruturas deve ser tratada como um pilar fundamental da infraestrutura nacional.
Os dados reforçam a relevância do tema. De acordo com dados do relatório do Cenário Global de Ameaças de 2026 da Fortinet® (NASDAQ: FTNT), líder global em cibersegurança que impulsiona a convergência entre redes e segurança, o Brasil concentrou 753,8 bilhões de tentativas de ataques ao longo de 2025, revelando que o cibercrime funciona como um sistema, com hackers criminosos atuando em todo o ciclo de vida do ataque e finalizando com agentes ocultos.
O volume coloca o Brasil entre os países mais visados da América Latina, evidenciando que a ameaça é também local e crescente. Setores como financeiro, governo e saúde seguem como os principais alvos, dada a criticidade dos dados que concentram e a dependência de sistemas digitais para a operação de serviços essenciais.
A combinação entre tensões geopolíticas, adoção acelerada de IA e lacunas de maturidade em segurança cria um ambiente de risco multidimensional, que exige das organizações uma postura cada vez mais proativa e estratégica.
“Enquanto as ameaças evoluem com o apoio de inteligência artificial e financiamento estruturado, muitas organizações ainda reagem de forma reativa. O momento exige uma mudança de mentalidade: cibersegurança precisa estar na mesa das lideranças executivas, com orçamento, governança e visão de longo prazo como vantagem competitiva e requisito de soberania”, conclui.
This blog is a focused update on the latest updates to the Ransomware Tool Matrix (RTM) and the Ransomware Vulnerability Matrix (RVM) covering three groups that I have published profiles for to help defenders home in on the threats most relevant to them: TheGentlemen, DragonForce, and WarLock.
Rather than write another broad ecosystem summary, the goal of this post is to introduce these profiles, briefly explain why each group matters right now, and give readers direct links to them so defenders can pivot straight into hunting, detection engineering, and patch prioritisation.
For anyone new to the projects, please read the descriptions on GitHub or feel free to watch my talk explaining the project at BSides London.
Why these three groups?
Each of the three groups added in this update represents a different slice of the current ransomware ecosystem:
TheGentlemen
TheGentlemen is a newer operation that has matured quickly, with a large and varied toolkit that reflects how cross-pollinated the affiliate ecosystem has become. The recent internal chat leak gave researchers a rare look into their tradecraft, and the profiles capture both the tooling and the exploited CVEs that have been observed across multiple intrusions. TheGentlemen’s RTM profile is here and RVM profile is here.
DragonForce
DragonForce has continued to escalate throughout 2025 and into 2026, branching into MSP-focused attacks and standing up its own "cartel" model that other affiliates can plug into. Its exploitation of edge devices (Ivanti, Fortinet, SonicWall) and SimpleHelp RMM make it a high-priority threat for any organisation using such systems. DragonForce’s RTM profile is here and RVM profile is here.
WarLock
WarLock jumped onto everyone's radar after the ToolShell SharePoint zero-day exploitation campaign, and has since been linked to a string of edge-application exploits including SmarterMail, SolarWinds Web Help Desk, and Gladinet CentreStack. It is a strong example of a likely China-based operator that lives on zero-day exploitation of internet-facing software. WarLock’s RTM profile is here and RVM profile is here.
Observations and Trends
A few themes are worth flagging across all three profiles:
BYOVD is now standard, not novel. All three groups have been observed bringing vulnerable drivers to disable or blind EDR. TheGentlemen with ThrottleStop driver, DragonForce with the TrueSight and Hangzhou Shunwang drivers, and WarLock with Antiy, NsecSoft, Rising, and VMTools drivers. If your detection stack is not yet hunting on or blocking suspicious driver loads and known-bad driver hashes, that is a high-priority gap to close.
Network edge devices and other internet-facing systems remain the front door to victim networks for these groups. Fortinet, Ivanti, SonicWall, SimpleHelp, Microsoft SharePoint, SmarterMail, SolarWinds Web Help Desk, and Gladinet CentreStack all appear across these three profiles. Patch prioritisation that focuses on internet-exposed appliances and admin tooling continues to give defenders a valuable return on effort.
Legitimate tooling continues to blur the line. Velociraptor, Cloudflared, VSCode Tunnels, AnyDesk, MeshCentral, FreeRDP, PuTTY, OpenSSH, and a long list of legitimate cloud services are all being repurposed for ransomware operations. Defender should use these lists to begin baselining what should exist in their environment and start alerting on the rest.
Conclusion
My recommendation for defenders remains the same as in previous updates: take the tools and CVEs from the RTM and RVM profiles and start threat hunting for their presence, writing detection rules to alert on certain behaviours, and blocking what is not expected or permitted in your environment. These three new profiles should make that easier to scope by group when you need to brief leadership, prioritise a hunt, or map your exposure to a specific campaign.
Here's a few sites that can help with turning the threat intel in these new profiles into detections:
As always, feedback and pull requests are very welcome on both repos. Thanks to everyone who has contributed reports, corrections, and ideas. These projects only stay useful because the community keeps feeding them one way or another.
Cybersecurity researchers at Fortinet have discovered Nexcorium, a new Mirai-based malware targeting TBK DVR systems to turn them into a botnet for DDoS attacks.
An single threat actor used AI tools to create and run a campaign that compromised more then 600 Fortinet FortiGate appliances around the world over five weeks, according to Amazon threat researchers, the latest example of how cybercriminals are using the technology in their attacks.
The exploitation of vulnerabilities targeting remote access technologies to gain initial access is continuing relentlessly also during 2025, with initial access brokers, and in general opportunistic and targeted threat actors, quite active in leveraging software flaws to break into organizations.
Entrar
We are observing exploitation of multiple Fortinet FortiSandbox vulnerabilities during the past 24 hours, including:
