What the Fortibleed campaign means for organizations running FortiGate firewalls

A widespread credential-harvesting campaign dubbed “FortiBleed” targeting FortiGate firewalls has exposed thousands of organizations. Researchers at ZenoX and CloudSEK recovered a trove of attacker tools, scripts, and harvested credentials from an exposed server and reconstructed a highly automated attack pipeline that in some cases achieved full domain-level control. Organizations running FortiGate appliances should treat this as urgent—assume possible compromise, prioritize investigation and remediation (credential rotation, forensic log review, apply vendor mitigations/patches, and hunt for