Analysis of Reported Credential Compromise of FortiGate Devices

Collection of Fortinet PSIRT blog analyses describing active exploitation and post‑exploitation activity against FortiGate/FortiOS devices. Topics include a reported credential compromise campaign dubbed “FortiBleed”, single sign‑on (SSO) abuse, observed abuse of advisory FG-IR-19-283, threat actor postings claiming stolen FortiGate configurations and VPN credentials, and exploitation of resolved N‑day vulnerabilities. Fortinet calls out active exploitation (including FG-IR-23-097 / CVE-2023-27997, rated Critical), provides investigation findings, IoCs, and mitigation/patching guidance to help