Vulnerabilities

Hello All. A massive credential exposure campaign dubbed FortiBleed is impacting internet-facing Fortinet FortiGate firewalls and VPN gateways worldwide.

Current reporting suggests 73,000–86,000+ Fortinet devices may be affected across 194 countries, with attackers harvesting verified credentials for administrative and SSL VPN access.

Important clarification:

FortiBleed is not a new CVE or zero-day.

This appears to be a large-scale credential compromise campaign involving:

  • Credential stuffing
  • Password spraying
  • Brute-force attacks
  • Reused / previously leaked passwords
  • Exploitation of older known Fortinet exposures

In other words, this is less about a brand-new vulnerability and more about a dangerous combination of:

  • Weak password hygiene
  • Internet-exposed management interfaces
  • Missing MFA
  • Poor credential rotation

For defenders, this reinforces a hard truth that the firewall is part of your attack surface – It’s not just a defensive tool—it’s also a high-value target.

Immediate actions, I recommend:

  • Rotate all FortiGate admin and VPN credentials
  • Enforce MFA on all remote access
  • Disable internet-facing management where possible
  • Review admin logins for anomalous IPs/geographies
  • Check for unauthorized config changes
  • Patch to latest FortiOS / review Fortinet PSIRT advisories

From an OT perspective, this matters even more.

Many industrial environments still rely on vendor VPN access, jump hosts, and perimeter firewalls to protect critical operations. A compromised edge device could become the initial access point into:

  • Power utilities
  • Manufacturing
  • Water treatment
  • Transportation
  • Critical infrastructure

This is exactly why identity + access security is now just as important as patching.

Read more

Hello All. The emergence of Claude Mythos is forcing a rethink across the cybersecurity landscape. Unlike earlier tools that assisted analysts, this new class of AI is capable of autonomously identifying and chaining together previously unknown vulnerabilities. What makes this particularly significant is not just speed, but depth—these systems can analyze legacy codebases and uncover flaws that may have existed, unnoticed, for decades.

This raises an uncomfortable question for OT environments that still rely heavily on legacy infrastructure. Consider a typical HMI running Windows XP: long past end-of-life, unpatched, and often deeply embedded into operations. For years, the assumption has been that most meaningful vulnerabilities were discovered before vendor support ended, and that residual risk could be managed through isolation and compensating controls. That assumption no longer holds.

The reality is that vendors like Microsoft never “found everything.” Vulnerability discovery has always been constrained by human effort, available tooling, and prioritization. AI changes that equation entirely. Systems like Claude Mythos can now revisit old platforms with fresh analytical capability, identifying flaws that were previously invisible—not because they were impossible to find, but because no one had the means to find them efficiently.

The real challenge emerges when new vulnerabilities are discovered in systems that are no longer supported. There are no patches, no vendor fixes, and often no practical way to upgrade without significant operational disruption. In effect, organizations are left running infrastructure where newly discovered weaknesses may persist indefinitely, potentially exploited without ever being publicly disclosed.

For OT environments, the impact is amplified. These systems are designed for stability and uptime, not rapid change. They often rely on insecure-by-design protocols, lack modern endpoint protections, and cannot be easily segmented or monitored using traditional IT approaches. When AI accelerates both discovery and exploitation, the window between vulnerability identification and active use shrinks dramatically—sometimes to near zero.

This shifts the risk model entirely. Security teams can no longer rely solely on known vulnerabilities or published CVEs. Instead, they must assume that unknown weaknesses exist and may already be discoverable by adversaries using similar AI capabilities. The focus moves from patching to containment, from prevention to detection, and from trust in legacy stability to acceptance of continuous exposure.

Ultimately, Claude Mythos represents more than a technological advancement—it exposes a long-standing blind spot in how organizations think about legacy risk. Systems like Windows XP were never “fully secured”; they were simply no longer being examined. Now, with AI re-opening that examination at scale, OT leaders must confront a new reality: the greatest risks may be the ones that have been sitting quietly in their environments all along.

Read more

Hello All. I wanted to pass on these pretty good technical details on the vulnerabilities affecting Microsoft Exchange on-premise:

After exploiting these vulnerabilities to gain initial access, HAFNIUM operators deployed web shells on the compromised server. Web shells potentially allow attackers to steal data and perform additional malicious actions that lead to further compromise. One example of a web shell deployed by HAFNIUM, written in ASP, is below:

Following web shell deployment, HAFNIUM operators performed the following post-exploitation activity:

  • Using Procdump to dump the LSASS process memory:

  • Using 7-Zip to compress stolen data into ZIP files for exfiltration:

  • Adding and using Exchange PowerShell snap-ins to export mailbox data:

  • Using the Nishang Invoke-PowerShellTcpOneLine reverse shell:

  • Downloading PowerCat from GitHub, then using it to open a connection to a remote server:

HAFNIUM operators were also able to download the Exchange offline address book from compromised systems, which contains information about an organization and its users.

Our blog, Defending Exchange servers under attack, offers advice for improving defenses against Exchange server compromise. Customers can also find additional guidance about web shell attacks in our blog Web shell attacks continue to rise.

Read more