n0n extortion operator exposed AI-aided attack files on open server
SOCRadar says every examined break-in used weak or stolen credentials, not a software vulnerability.
74
Product
FortiGate
- Mentions · 7d5
- Mentions · 30d25
- All mentions34
- First seenAug 12, 2026
- Last mentioned14h ago
Timeline
34 articles · newest firstFortiBleed 2.0 finds 40,573 cleartext secrets in FortiGate configs
Hudson Rock parsed 1,703 FortiGate configuration reports and 1,689 host identifiers; 975 domain labels were absent from the earlier set.
58
FortiBleed 2.0 finds 40,573 cleartext secrets in exposed FortiGate configs
The follow-up is stolen configuration files, not a new Fortinet flaw, and the records are not confirmed still valid.
66
CyberStrikeAI’s 44 agents automated attacks on Japan organizations
Other listed targets included Taiwan, Hong Kong, the UK, France, Italy, Qatar, and Colombia.
74
Check Point weekly brief covers Onamae intrusion, PHP exploits, GitLab RCE
The October 26 bulletin also flags an exploited Arista flaw, a LiteLLM package compromise, and the Aokigahara infostealer.
66
k0t exploits edge firewalls and VPNs, exposing over 70,000 credentials
Group-IB and NyxLab say k0t used FortiWeb and PAN-OS flaws, then remote-access tools and cloud exfiltration, from February to June 2026.
78
k0t steals credentials from FortiGate, FortiWeb and GlobalProtect
Group-IB reports more than 70,000 exposed credentials and active use of CVE-2025-64446 and CVE-2026-0257.
78
Operators hit FortiGate, FortiWeb and GlobalProtect to steal stored passwords
Group-IB and NyxLab tie the edge-device campaign to k0t and report more than 70,000 exposed credentials.
78
UNC5820 used Fortinet zero-days to plant PeerStitch at a telecom
CISA added CVE-2025-61624 to KEV; the memory-only implant rides legitimate FortiGate process traffic.
84
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
Unit 42 says PEERSTITCH, planted through FortiManager flaws, exposed material for more than 500 firewalls.
82
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
Unit 42 says CL-STA-0954 used Fortinet flaws to deploy memory-resident PEERSTITCH against a telecom provider.
84
New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory
Unit 42 details PEERSTITCH, a memory-resident implant used against FortiGate firewalls at a telecom MSP.
80
Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Attackers exploited Fortinet flaws at a telecom MSP and deployed the stealthy PEERSTITCH implant on FortiGate firewalls.
82
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
Unit 42 says UNC5820 stole data on 500-plus FortiGates and deployed memory-resident PEERSTITCH malware.
84
12th October – Threat Intelligence Report
Check Point's weekly report covers a Denmark registry breach of 8.8 million people, ransomware, and exploited enterprise flaws.
82
FBI: FortiBleed attackers can lock organizations out of their own firewalls
FBI says FortiBleed operators hit over 80,000 FortiGate devices and can lock victims out of firewalls.
84
FBI and Secret Service Warn of FortiBleed Lockout Threat
FBI and Secret Service warn FortiBleed has compromised 86,644 Fortinet devices and can lock out administrators.
84
FortiBleed Attackers Locking Victims Out of Fortinet Devices
FortiBleed attackers compromised about 86,644 Fortinet devices and are locking organizations out by changing passwords.
84
FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins
FBI says ongoing FortiBleed attacks still lock FortiGate VPN admins out using leaked and cracked credentials.
84
FortiBleed Attack Campaign Exploiting Fortinet Firewalls and VPNs – FBI Warns
FBI warns FortiBleed compromised over 86,000 Fortinet firewalls and VPNs in 194 countries.
88
FBI, Secret Service add to warnings of FortiBleed credential stealing campaign
FBI and Secret Service say FortiBleed compromised over 86,000 Fortinet firewalls in 194 countries.
90
FBI Warns FortiBleed Campaign Targeting Fortinet Firewalls and VPNs to Steal Credentials
FBI warns FortiBleed operators compromised over 86,000 Fortinet firewalls and VPNs to steal credentials for ransomware brokers.
86
FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
FBI and Secret Service warn FortiBleed is still harvesting Fortinet firewall credentials, with 86,644 logins tied to ransomware access brokers.
84
Stellar Cyber 7.0 adds measurable workflows for AI-powered SOCs
Stellar Cyber 7.0 adds measurable AI case triage, richer evidence, and broader automated SOC response.
34
Fortinet sounds the alarm over actively exploited FortiMail zero-day
Fortinet says attackers are exploiting critical FortiMail zero-day CVE-2026-104286 to write files without authentication.
88
PAYLOAD Ransomware Abuses Active Directory Group Policy to Disrupt Entire Windows Domain
PAYLOAD ransomware abused Active Directory Group Policy to disrupt a Windows domain without using file encryption.
75
Hackers Allegedly Selling Fortinet FortiGate 1-Day Vulnerability on Underground Forums
An unverified underground listing offers a claimed FortiGate SSL VPN RCE exploit for FortiOS 7.2.x/7.4.x amid ongoing exploitation of known Fortinet flaws.
64
CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
CISA adds actively exploited Cisco, Citrix, and Fortinet edge-device flaws to KEV catalog, ordering federal agencies to patch by September 12, 2026.
85
Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks
Threat actors exploit Fortinet heap-based buffer overflow CVE-2025-25249 to deploy PivotC2 RAT, infecting 178 devices and exfiltrating data from US targets.
82
Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT
SOCRadar says attackers exploit FortiGate CVE-2025-25249 to deploy the PivotC2 Node.js RAT, compromising 178 of 30,000 targeted devices and stealing credentials.
72
The 12 Best Managed Firewall Services, Compared and Priced
GBHackers compares 12 managed firewall service providers, naming Fortinet best value and Secureworks best detection while flagging recent ownership changes.
12
CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT
Attackers exploiting CVE-2025-25249 in Fortinet FortiGate firewalls deploy PivotC2, a post-exploitation RAT, on exposed edge devices.
74
GentleKiller targets more than 400 security processes across 48 products
ESET details the Gentlemen ransomware gang's in-house GentleKiller EDR-killer framework targeting over 400 security processes across 48 products, supplied to affiliates.
68
FGFM Authentication Weakening via CLI Configuration
FortiManager FGFM flaw (CVSS 7.3) lets an attacker with a valid certificate impersonate any managed FortiGate under a specific CLI option.
40
Related CVEs
by mentions- CVE-2024-4757595%9.8Unauthenticated RCE in Fortinet FortiManager and FortiManager Cloud
- CVE-2025-616241%6.5Authenticated path traversal in Fortinet FortiOS and related products
- CVE-2025-252494%9.8Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE
- CVE-2025-6444691%9.8Unauthenticated Path Traversal in Fortinet FortiWeb Enables Admin Command Execution
- CVE-2026-025795%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2024-26009<1%8.1An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16…
- CVE-2024-26008<1%5.3An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version…
- CVE-2026-1146251%9.4SQL injection in Arista VeloCloud Orchestrator grants superuser
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2019-66937%6.5Hard-Coded Encryption Key in Fortinet FortiOS Configuration Backups
Appears with
- Fortinetvendor · 32
- FortiOSproduct · 13
- SOCRadarorganization · 9
- FBIorganization · 8
- Lynxthreat actor · 7
- FortiManagerproduct · 7
- FortiSwitchManagerproduct · 6
- INCthreat actor · 6
- CISAorganization · 6
- CL-STA-0954threat actor · 6
- PeerStitchmalware · 6
- UNC5820threat actor · 6
- Fortinetorganization · 5
- Palo Alto Networksorganization · 5
- Unit 42organization · 5
- Payloadmalware · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.