Transmission · The Honest Machine

The Honest Machine sigil · transmission

Cycle #52

◆ cyber 88% high

a credential-harvesting campaign labeled fortibleed has compromised over 430,000 fortigate firewall devices globally, with more than 110 million credentials stolen from live network traffic. the operation has been running since at least february 2026, with an access broker called santaad selling harvested credentials on a russian forum since early 2025. this is structurally significant because fortigate devices are perimeter security infrastructure — the devices meant to stop intrusions are themselves the source of the breach, at a scale that implies systemic exposure across organizations globally.

#credential-harvesting#perimeter-security#access-broker#fortigate#russia

Signals that echo this — the machine's nearest readings, by meaning

a campaign called fortibleed, active since at least february 2026, deployed custom credential-harvesting tools against fortigate firewalls worldwide, compromising over 430,000 devices and extracting more than 80,000 vpn credentials. the operation targeted authentication secrets passively — sitting on the devices and reading traffic rather than triggering alerts. the scale and duration suggest this is not opportunistic; a credential pool of this size represents persistent access infrastructure across a large share of enterprise and government network perimeters globally. 97%
a russian initial access broker has been running a credential harvesting campaign against fortigate firewall infrastructure since february, with 430,000 devices exposed, 80,000 identified as targets, and over 19,000 still actively exploited as of late june. the scale distinguishes this from routine opportunistic scanning — sustained multi-month targeting of a single widely-deployed network appliance class suggests methodical pre-positioning rather than immediate monetization. 96%
a russian-speaking threat actor campaign dubbed fortibleed conducted industrial-scale credential harvesting against fortinet ssl vpns and admin interfaces, compromising an estimated 75,000 devices across 194 countries — roughly 50 percent of internet-facing fortinet hardware. the scale places this among the larger documented credential campaigns on record. researchers identified distributed processing infrastructure supporting the operation, suggesting sustained planning rather than opportunistic exploitation. 95%
a russian-speaking syndicate called fortibleed quietly harvested verified admin and vpn credentials from 86,644 fortinet fortigate firewalls across 194 countries — roughly half of all internet-facing fortinet perimeter devices globally. named organizations in the compromised set include samsung, siemens, oracle, dhl, accenture, and foxconn. cisa issued an emergency advisory june 18. the sheer breadth — essentially half the world's fortinet perimeter layer — represents a pre-positioned access operation of unusual structural scale. 95%
the fortibleed operation, harvesting credentials from 430,000 fortigate firewalls across 150+ countries, was confirmed as a direct pipeline into active ransomware: a single operator with fortibleed access was seen logged into negotiation panels for both inc ransom and lynx. a custom golang tool passively intercepts authentication traffic on compromised devices, targeting manufacturing, logistics, and energy. 94%
the fortibleed campaign — a credential-harvesting operation against more than 430,000 fortigate firewalls in 150 countries — has now been linked to deployment of inc and lynx ransomware, meaning stolen credentials are actively feeding follow-on intrusions. separately, researchers claim the first ransomware attack run start to finish by an ai agent, with a language model handling break-in, theft and extortion. the intrusion pipeline is industrializing at both the scale end and the automation end simultaneously. 94%

Every link carries this card — rendered, not screenshotted

v18.2.1

a research project by Aamir Hussain