FortiBleed: SafeBreach Coverage for Joint Cybersecurity Advisory JCSA-20261006-01

The report summarizes the FBI/USSS joint advisory on FortiBleed, a global credential-harvesting operation that scanned internet-exposed FortiGate SSL VPN portals, used password spraying and credential stuffing to obtain FortiOS user databases and session tokens, cracked weak SHA-256 hashes at scale, created rogue admin accounts, enumerated Active Directory, and enabled ransomware affiliates; it includes mapped MITRE ATT&CK TTPs, IOCs, SafeBreach simulation coverage, and recommended hardening steps.