trade-press
FortiBleed still locks out users and feeds ransomware
Patch and password reset aren't enough when the attacker can disable accounts or change passwords.
The FBI and Secret Service warned Tuesday that FortiBleed, the credential-compromise campaign against Fortinet firewalls and VPN gateways, remains active and has been observed as an entry point for ransomware affiliates. SOCRadar verified more than 86,644 compromised devices across 194 countries when the campaign surfaced; its CISO says a later review counted 400,000 to 450,000 firewalls targeted in the wider operation, while cautioning the figures aren't directly comparable. The alert says attackers can disable accounts or change passwords, which forces remediation beyond standard patching and password resets.