Kevin Beaumont has an update on FortiBleed, and it is not getting smaller. Attackers are pulling FortiGate configurations and cracking the password hashes at scale on rented GPU clusters, with roughly 75,000 devices hit and around 1,000 organizations now showing confirmed internal breaches. The follow-on is the usual playbook: logins to legit staff accounts, edited firewall rules, and a pile of long-dormant backdoor admin accounts left by an earlier ransomware crew. Telecoms and managed service providers are singled out. The device you bought to keep attackers out is, once again, the way in.
