FortiBleed: You Cannot Patch a Valid Login by Lucie Cardiet

A researcher discovered a leaked catalogue of validated usernames and passwords for tens of thousands of internet-facing Fortinet firewalls (approximately 86,644 devices across 194 countries) assembled by a brokered criminal campaign called FortiBleed/SantaAd; attackers used large-scale brute force, reused leaked credentials, and GPU cracking to gather credentials, then validated, ranked by target value, and auctioned access to ransomware/extortion groups—creating widely usable legitimate logins that are difficult to detect because they appear as normal successful authentications.