Podcast: FortiBleed—The Campaign With No CVE That Locks You Out of Your Own Firewall

The transcript covers the joint FBI/U.S. Secret Service advisory on “FortiBleed,” a credential-harvesting operation targeting internet-facing FortiGate SSL VPNs that produced tens of thousands of working credentials; actors used credential stuffing, password cracking of legacy SHA‑256 admin hashes, and created local admin accounts to maintain access and in some cases lock victims out of their firewalls while selling access to ransomware affiliates—advisory guidance recommends terminating sessions, rotating credentials and API keys, enforcing phishing-resistant MFA, validating configs and hunting/eviction steps.