FortiBleed Hits 430K Firewalls: 4 Threats to Prioritize This Week
Retool's new app builder is where AI-generated code ships safely
Building apps with AI is easy. Getting them to production safely is another story.
FortiBleed FortiGate credential theft has compromised over 430,000 firewalls worldwide, deploying a custom interception tool on 19,000 devices and feeding stolen VPN credentials directly into INC ransomware attacks. Researchers confirmed this week that organizations on the INC ransomware leak site overlap directly with FortiBleed victims, closing the loop on a two-stage attack chain: firewall credential theft first, ransomware intrusion second.
All four threats are active now. The remediation actions are specific and time-sensitive.
How Does the FortiBleed Credential Theft Campaign Work?
The FortiBleed campaign targets unpatched FortiGate SSL-VPN appliances, deploying a custom "FortiGate Sniffer" inside FortiOS that passively intercepts VPN authentication traffic: usernames, passwords, and session tokens.
Fortinet has published firmware advisories. Organizations that have not applied patches from 2025 Q4 onward should treat their FortiGate devices as potentially compromised. Credential rotation is mandatory, not optional.
The Ransomware Pipeline: How FortiBleed Feeds INC and Lynx
Researchers confirmed that victim organizations on the INC ransomware leak site overlap directly with FortiBleed victims: stolen FortiGate VPN credentials provide initial access for ransomware operators authenticating as legitimate remote employees.
Any FortiGate appliance running pre-2025-Q4 firmware should be treated as a credential exposure incident. The follow-on ransomware risk is confirmed, not theoretical.
Subscribe to unlock Indicators of Compromise
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Threat #2: Storm-1175 and the Medusa Ransomware Zero-Day Playbook
Storm-1175 is a China-based Medusa ransomware affiliate formally attributed by Microsoft in April 2026. The group has weaponized 16 vulnerabilities across 10 products including zero-days in GoAnywhere MFT (CVE-2025-10035, CVSS 10) and SmarterMail, with confirmed initial-access-to-ransomware timelines under 24 hours.
Organizations running GoAnywhere MFT or SmarterMail need patches applied before end of business today.
Threat #3: Spirals Ransomware Encrypts Networks in Under 24 Hours
Spirals is a newly identified ransomware family that BleepingComputer reported this week, having completed a full network intrusion against an IT services firm in South Asia in under 24 hours from initial access through encryption. The speed is operationally significant: most enterprise ransomware defenses are built around detection-and-response timelines that assume days of dwell time for credential harvesting and lateral movement preparation.
IIS remains a persistent blind spot in many enterprise environments. Legacy application hosting on Windows Server often leaves IIS exposed with minimal monitoring, and ASP.NET webshell deployment via IIS bypasses many endpoint detection tools focused on process-level events rather than web request analysis. Any organization with internet-accessible IIS instances should audit web directories for unexpected .aspx or .ashx files immediately.
Threat #4: Lazarus Group Poisons npm to Target 295K Developers
North Korea's Lazarus Group planted six malicious npm packages in the public registry this week, masquerading as utilities compatible with rollup-plugin-polyfill-node, a legitimate library with approximately 295,000 weekly downloads. JFrog Security Research identified and reported the packages to npm for removal. The campaign fits Lazarus Group's documented pattern of targeting developer environments to reach downstream victims and steal credentials, cryptocurrency wallets, and sensitive code repositories.
Any developer who ran rollup-related npm installs in the past week should audit their package-lock.json for unexpected additions. Check for socket.io-client, ssh2, or node-pty added without explicit team intent. Any developer machine that installed a malicious package before removal should be reimaged rather than cleaned, given the level of remote access the attacker established.
Subscribe to unlock Indicators of Compromise
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Sigma Detection Rules for FortiBleed and IIS Webshell Activity
No CVE-specific Sigma rules exist yet for the FortiBleed sniffer deployment, as the FortiGate Sniffer is a custom tool rather than a named exploit. Detection coverage relies on behavioral rules that catch the configuration tampering and credential access patterns observed in FortiBleed-linked incidents. Two FortiGate-specific rules and one IIS credential access rule provide the strongest coverage for today's threat set. Convert YAML to your SIEM's native syntax using sigma-cli: sigma convert -t splunk rule.yml or sigma convert -t microsoft365defender rule.yml.
Subscribe to unlock Sigma Detection Rules
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
What Your Security Team Must Check Before End of Business Today
Four threats, four specific action sets. Priority order follows confirmed exploitation evidence and blast radius.
FortiBleed affects every organization running FortiGate SSL-VPN. Storm-1175 targets GoAnywhere MFT and SmarterMail deployments specifically. Spirals targets any internet-accessible IIS server. Lazarus Group targets developer workstations with npm access.
Start with FortiGate: force credential rotation first, then patch, then investigate. The credential pipeline to ransomware is live. Rotation interrupts it immediately even before investigation is complete.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
The bottom line
FortiBleed FortiGate credential theft is the highest-urgency threat this week: 430,000 firewalls targeted, 19,000 actively intercepting VPN credentials, and confirmed victim overlap with INC ransomware. Storm-1175 is exploiting zero-days in GoAnywhere MFT and SmarterMail with a 24-hour intrusion clock. Spirals ransomware hit full network encryption in under 24 hours via exposed IIS. Lazarus Group is targeting developer workstations through malicious npm packages. Force FortiGate VPN credential rotation, patch GoAnywhere MFT and SmarterMail, audit IIS web roots for webshells, and run npm audit today.
This analysis is generic — the platform version scores threats like this against your own stack.
Frequently asked questions
What is FortiBleed and how does it steal credentials?
FortiBleed is a large-scale credential theft campaign targeting FortiGate firewalls. Attackers exploit unpatched SSL-VPN vulnerabilities to deploy a custom tool called FortiGate Sniffer that runs within FortiOS and intercepts VPN authentication traffic in real time. Stolen credentials including usernames, passwords, and session tokens are exfiltrated to attacker infrastructure and later used for ransomware intrusions. Researchers confirmed this week that INC ransomware victims overlap directly with FortiBleed targets.
How many organizations are affected by FortiBleed?
Researchers identified over 430,000 FortiGate firewalls as targets in the FortiBleed campaign. Of those, approximately 19,000 had the FortiGate Sniffer actively deployed, meaning VPN credentials were being actively intercepted in real time. Any organization running FortiGate SSL-VPN on firmware older than 2025 Q4 should assume credential exposure occurred and force a full VPN credential rotation immediately.
What is INC ransomware and how does it use FortiBleed credentials?
INC ransomware is a ransomware-as-a-service operation active since 2023, known for double-extortion attacks against healthcare, manufacturing, and professional services. Affiliates use stolen FortiGate VPN credentials to authenticate through the firewall as a legitimate remote employee, bypassing perimeter detection. Once inside, they use PsExec, WMI, and PowerShell to move laterally and disable backups before encrypting data and threatening to publish exfiltrated files.
What is Storm-1175 and which vulnerabilities is it exploiting?
Storm-1175 is a China-based, financially motivated threat group that Microsoft attributed in April 2026 as a Medusa ransomware affiliate. The group has exploited 16 vulnerabilities across 10 software products, including zero-days in GoAnywhere MFT (CVE-2025-10035, maximum CVSS severity) and SmarterMail (CVE-2026-23760). Storm-1175 moves from initial access to ransomware deployment in as little as 24 hours, often exploiting internet-facing products with no phishing required.
Is Spirals ransomware related to any known threat actor?
Spirals is a newly identified ransomware family with no confirmed attribution to any previously tracked threat actor. The group is operationally distinct from existing named families and is defined by its rapid execution: full network compromise and encryption completed in under 24 hours in the confirmed incident. Initial access was gained via an exposed IIS server with an ASP.NET webshell. Attribution investigation is ongoing.
Which npm packages are malicious in the Lazarus Group campaign?
JFrog Security Research identified six malicious npm packages masquerading as rollup-plugin-polyfill-node utilities, submitted them to npm for removal, and published an advisory with current package names. Developers should check the JFrog advisory directly, as the list updates as additional packages are identified. Any developer who installed rollup-adjacent packages in the past week should run npm audit and look for unexpected socket.io-client, ssh2, or node-pty dependencies.
How do I detect if my FortiGate was hit by FortiBleed?
Indicators include unexpected processes in FortiOS logs, unexplained outbound connections to non-Fortinet infrastructure, and FortiGate firmware older than 2025 Q4. Even without specific indicators, any FortiGate running older firmware should be treated as compromised. The two FortiGate Sigma rules in this post detect VPN SSL configuration tampering associated with FortiBleed post-exploitation activity. Enable FortiOS syslog forwarding to your SIEM and deploy these rules immediately.
What should developers do immediately about the Lazarus npm packages?
Run npm audit in every active repository. Review package-lock.json for any installs from the past two weeks that introduced socket.io-client, ssh2, or node-pty without explicit team requirement. Audit developer machines for unexpected persistent SSH processes or unusual outbound socket connections. Any machine confirmed to have installed a malicious package should be reimaged rather than remediated, given the remote control access Lazarus Group establishes during infection.
Sources & references
- BleepingComputer: FortiBleed Credential Theft Campaign Linked to Lynx Ransomware
- BleepingComputer: Microsoft Links Medusa Ransomware Affiliate to Zero-Day Attacks
- BleepingComputer: New Spirals Ransomware Encrypts Victim Network in Under 24 Hours
- JFrog Security Research: Rollup Polyfill Masquerading — Lazarus Group npm Supply Chain Campaign
- The Hacker News: SharePoint RCE CVE-2026-45659 Added to CISA KEV by Storm-2603
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
Win a $2,495 Black Hat pass.
Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.