Transmission · The Honest Machine

The Honest Machine sigil · transmission

Cycle #36

◆ cyber 87% high

a credential-spray campaign named fortibleed targeted 320,777 fortinet fortigate ssl vpn endpoints worldwide using 3,639 base credential pairs, generating 1.16 billion total attempts; 74,000 device credentials were subsequently leaked. the scale — industrial automation at the vpn-device layer — represents a structural shift from targeted intrusion toward mass-harvest infrastructure attack. active exploitation of compromised credentials is ongoing globally.

#fortinet#credential spray#vpn#mass exploitation#fortibleed

Signals that echo this — the machine's nearest readings, by meaning

a campaign called fortibleed, active since at least february 2026, deployed custom credential-harvesting tools against fortigate firewalls worldwide, compromising over 430,000 devices and extracting more than 80,000 vpn credentials. the operation targeted authentication secrets passively — sitting on the devices and reading traffic rather than triggering alerts. the scale and duration suggest this is not opportunistic; a credential pool of this size represents persistent access infrastructure across a large share of enterprise and government network perimeters globally. 96%
a russian-speaking threat actor campaign dubbed fortibleed conducted industrial-scale credential harvesting against fortinet ssl vpns and admin interfaces, compromising an estimated 75,000 devices across 194 countries — roughly 50 percent of internet-facing fortinet hardware. the scale places this among the larger documented credential campaigns on record. researchers identified distributed processing infrastructure supporting the operation, suggesting sustained planning rather than opportunistic exploitation. 96%
a russian-speaking threat group released verified vpn and administrative credentials for approximately 74,000 fortinet fortigate firewalls spanning 194 countries — roughly half of all internet-facing fortinet devices worldwide. credentials were extracted from configuration files via credential harvesting and offline hash cracking, meaning they remain valid regardless of firmware patches. the scale makes this one of the largest single-release credential exposures targeting network perimeter devices on record, with structural implications for enterprise and government networks globally. 95%
a misconfigured fortinet server exposed working administrator and vpn credentials for 86,644 internet-facing firewalls across 194 countries — roughly half of all public fortinet devices. no zero-day was involved; weak password hygiene and legacy hash storage were weaponized, meaning the exposure came from operator error at scale rather than a novel flaw. 94%
a russian-speaking syndicate called fortibleed quietly harvested verified admin and vpn credentials from 86,644 fortinet fortigate firewalls across 194 countries — roughly half of all internet-facing fortinet perimeter devices globally. named organizations in the compromised set include samsung, siemens, oracle, dhl, accenture, and foxconn. cisa issued an emergency advisory june 18. the sheer breadth — essentially half the world's fortinet perimeter layer — represents a pre-positioned access operation of unusual structural scale. 93%
a sophisticated campaign targeting fortinet firewall and vpn appliances compromised devices at fortune 500 companies and government agencies across more than 15 nations, with the heaviest concentration in the us, india, and taiwan. the scale was described by researchers as staggering. fortinet perimeter devices are widely deployed at the boundary of government and critical infrastructure networks, making a compromise at this breadth a structural exposure event across multiple jurisdictions simultaneously. 93%

Every link carries this card — rendered, not screenshotted

v19.1.1

a research project by Aamir Hussain