Fortinet "FortiBleed" Global Compromise & Active Exploitation of Fortinet Vulnerabilities

A large-scale, ongoing campaign named "FortiBleed" is compromising internet-facing Fortinet infrastructure worldwide by reusing stolen credentials, conducting massive brute-force attempts, and in some instances weaponizing recent Fortinet product vulnerabilities; the operation has impacted tens of thousands of devices across 190+ countries and targets FortiGate, FortiSandbox, FortiClient EMS and associated VPN/administrative interfaces. The report provides technical details on the intrusion chain, observed post-exploitation activity (persistence, lateral movement, credential harvesting), sample IoCs (account names and several IP addresses), and prioritized mitigations including credential rotation, MFA enforcement, patching, and restricting management interface exposure.