FortiBleed Campaign Used Custom FortiGate Sniffer to Steal Credentials

SOCRadar's analysis describes the FortiBleed campaign, where attackers exploited FortiGate vulnerabilities to deploy custom, stealthy packet sniffers that parse FortiOS session formats and exfiltrate administrative and VPN credentials at scale; Fortinet has released patches and IOCs, and organizations are advised to patch, rotate credentials, audit logs, and implement segmentation and integrity monitoring.