FortiBleed: 86,000 Fortinet Device Credentials Compromised

CISA is warning organizations about FortiBleed, a massive credential theft campaign that has compromised over 86,000 internet-facing Fortinet firewalls and VPNs across 194 countries. Russian-speaking threat actors have compiled a verified database of working usernames and passwords through automated testing, representing roughly half of all internet-facing Fortinet devices, and have been using a 45-GPU cluster to crack password hashes and pivot into corporate networks. CISA is urging affected organizations to immediately reset credentials, enable multi-factor authentication, and review logs for suspicious activity, as thousands of organizations including government entities and critical infrastructure providers have been impacted.