Monday Intel Drop: 5 Active Exploits Your Team Must Address This Week

The weekly cybersecurity threat briefing leads with FortiBleed because the credential exposure is ongoing and the window to rotate credentials before an attacker succeeds continues to shrink. A Russian-speaking criminal group extracted configuration files from internet-facing FortiGate devices and cracked stored administrator password hashes using a 45-GPU offline cracking infrastructure, yielding verified working credentials for 73,932 FortiGate firewalls, VPN gateways, and SSL-VPN instances across 194 countries.

Affected organizations confirmed by researchers include Samsung, Siemens, Foxconn, Oracle, Accenture, DHL, Infosys, and Fortinet itself. Security researcher Volodymyr Diachenko identified the leaked credential database on an exposed server, but the data had already propagated across criminal forums before discovery.

The attack exploits a weakness in FortiOS credential migration: when devices upgrade from older firmware versions, administrator passwords remain stored as weaker SHA-256 hashes until an administrator manually logs in post-upgrade. Attackers brute-forced those hashes at scale with a GPU cluster. Approximately 1.16 billion authentication attempts targeted over 320,000 FortiGate devices, with roughly 50 percent of all internet-reachable FortiGate instances estimated as affected across 194 countries.

CISA issued an advisory on June 18 ordering immediate action. Fortinet confirmed the breach vector in its PSIRT blog. See the full FortiBleed credential leak analysis for detailed forensic indicators and configuration validation commands.

A 24 billion username-and-password combination dataset was discovered on a publicly accessible elasticsearch server with no authentication configured, representing one of the largest credential aggregation leaks on record. The database consolidates data from hundreds of prior breaches and credential-stuffing campaigns into a single searchable resource that threat actors are actively querying for account takeover operations against enterprise VPNs and cloud consoles.

Unlike a targeted breach of a single organization, this aggregated dump creates persistent risk for any organization whose employees use personal email addresses or reuse passwords across corporate and consumer accounts. The dataset contains corporate email addresses, consumer accounts linked to enterprise SSO systems, and service account credentials harvested from prior vendor breaches.

Threat actors use these aggregated dumps to execute credential-stuffing attacks at scale against enterprise identity providers, VPN portals, and partner extranet systems. Given the timing alongside the FortiBleed campaign, any organization with both a compromised FortiGate credential in the FortiBleed database and employee passwords in this dump faces a compounded risk: attackers can pair firewall admin credentials with corresponding employee accounts for coordinated intrusion.

The full 24 billion credential exposure breakdown covers verification steps organized by identity provider and corporate domain.

Sapphire Sleet is a North Korean APT tracked by Microsoft as Sapphire Sleet and by Recorded Future as BlueNoroff and UNC4899, specializing in financial theft and supply chain infiltration since at least 2019. In the week of June 22, CYFIRMA and Recorded Future confirmed the group embedded the Mastra backdoor into multiple npm packages, with activity attributed to cluster CL-STA-1062 targeting state-owned enterprises in energy and government sectors.

The attack method begins with fake recruiter messages on LinkedIn and GitHub directing developers to install technical assessment packages. Infected packages included components from the Mini Shai-Hulud, Miasma, and Hades malware family, which propagated from npm into the Go ecosystem through transitive dependency chains. Once installed, the implant establishes persistence through scheduled task entries and Windows registry modifications before exfiltrating cryptocurrency wallet credentials, source code repositories, and corporate authentication tokens.

The Go ecosystem propagation path is particularly dangerous because Go module checksums may not detect a malicious transitive dependency if the compromised npm package was already pinned in a lockfile before the attack was identified. Developer workstations that installed affected packages during the week of June 22 should be treated as potentially compromised.

The complete technical analysis including all affected package names and hashes is in our Sapphire Sleet supply chain attack investigation.

CISA added three Ubiquiti UniFi OS vulnerabilities to the Known Exploited Vulnerabilities catalog on June 23, 2026, with a mandatory federal patch deadline of June 26. That deadline has passed. Any federal agency or contractor with UniFi devices that has not applied the available patches is in active violation of BOD 26-04.

CVE-2026-34908 (CVSS 10.0, CWE-284) is an improper access control flaw allowing unauthenticated configuration changes to UniFi OS without any credentials. CVE-2026-34909 (CVSS 10.0, CWE-22) is a path traversal vulnerability enabling file read and manipulation. CVE-2026-34910 (CVSS 10.0, CWE-20) is an improper input validation flaw allowing arbitrary OS command injection on the host. Chained together, an attacker on the same network segment achieves root-level code execution on any UniFi OS device without authentication.

Affected devices include UniFi Cloud Gateways, Network Controllers, Protect NVRs, Access Hubs, and Talk appliances. Active exploitation includes a Mirai and Gaafgyt botnet campaign systematically scanning for vulnerable UniFi devices on ports 443 and 8443, incorporating compromised devices into DDoS infrastructure.

Patches have been available since May 22, 2026: UniFi OS Server 5.0.8+ and firmware 5.1.12+ (Express 4.0.14, UNAS 5.1.10).

ShinyHunters is a financially motivated cybercriminal group (tracked by Mandiant as UNC6240) that has operated since 2020, responsible for more than 400 confirmed organizational breaches. The group is actively exploiting CVE-2026-35273, a CVSS 9.8 unauthenticated remote code execution vulnerability in Oracle PeopleSoft PeopleTools 8.61 and 8.62, in a campaign that began May 27 and continued through the week of June 28.

Moreover than 100 organizations were compromised before Oracle issued its emergency patch on June 10, with 68 percent of victims confirmed as higher education institutions. ShinyHunters published a fresh set of claimed victims on June 28, indicating the group continues to find organizations that have not yet applied the Oracle emergency patch or that patched too late to prevent initial access.

The exploitation technique targets the PeopleSoft Environment Management Hub via HTTP POST requests to /PSEMHUB/hub and /PSIGW/HttpListeningConnector, requiring no credentials and no user interaction. After gaining access, the group deploys MeshCentral agents branded as Microsoft Azure services for persistent access, then exfiltrates employee HR data, salary records, and student information via SSH to attacker-controlled infrastructure.

Organizations running PeopleSoft PeopleTools 8.61 or 8.62 that applied the Oracle June 10 emergency patch more than 48 hours after its release should conduct a full log review for exploitation indicators dating back to May 27.

Five simultaneous active threat campaigns across network infrastructure, supply chain, credential markets, IoT devices, and enterprise applications signal what security researchers have documented as a late-June acceleration pattern. Criminal groups and state-sponsored APTs increase operational tempo before the July holiday period, anticipating reduced security staffing and delayed response times in Western enterprise environments.

FortiBleed, the 24 billion credential dump, and the Ubiquiti botnet campaign are opportunistic: they target organizations that have not maintained consistent patching and credential hygiene. Sapphire Sleet and ShinyHunters are targeted operations requiring specific intelligence about which organizations run affected software.

For any organization with FortiGate devices or Ubiquiti infrastructure, this week should be treated as an active incident response scenario until devices are confirmed patched and credentials rotated. The 73,932 FortiGate credential sets in the FortiBleed database are being tested continuously. Organizations that rotate credentials today face significantly lower risk than those that wait until the July maintenance window.

The Sapphire Sleet supply chain vector introduces a distinct category of risk. Developer workstations that installed affected npm packages during the week of June 22 should be treated as potentially compromised, with a full EDR investigation initiated before those machines are used to deploy to production infrastructure. Credential theft from developer environments provides access to source code repositories, CI/CD pipelines, and cloud infrastructure at a blast radius far exceeding a single compromised endpoint.