CuraSec

tag: Credential-Harvesting · 2 items

Act FBI: FortiBleed Credential Campaign Still Active, 86K+ Devices Hit
2026-10-07 · The Hacker News · source ↗ #fortinet#credential-harvesting#vpn-security
  • Engineer — Act: FBI/USSS joint advisory confirms active harvesting against internet-facing FortiGate and SSL VPN devices via reused credentials and legacy SHA-256 password storage. Immediately rotate all Fortinet admin and VPN credentials, disable SHA-256 legacy password configs, and enforce MFA on management interfaces.
  • SOC/IR — Act: The campaign’s scale and active status mean affected devices may already be compromised before patching. Sweep authentication logs for anomalous VPN logins and lateral movement since campaign onset; apply assume-breach posture for any internet-exposed FortiGate or SSL VPN in your estate.
  • Leader — Act: A joint FBI/Secret Service advisory citing 86,000+ harvested credentials from widely-deployed network perimeter devices is board-question territory. Confirm whether Fortinet FortiGate or SSL VPN is in use, request an exposure assessment from the infrastructure team, and prepare a brief for leadership before they read this in the news.
Act archived Microsoft TI: LiteLLM gateways actively exploited for cred theft and cryptomining
2026-08-27 · Microsoft Security Blog · source ↗ #ai-infrastructure#credential-harvesting#cryptomining
  • Engineer — Plan: Microsoft Threat Intelligence documents active exploitation of exposed LiteLLM gateways leading to credential theft and persistence — no KEV or PoC signal, but if you run LiteLLM or similar AI proxies, audit internet exposure, rotate API keys, and verify no unauthorized processes are running on those hosts.
  • SOC/IR — Act: Active attack chain with detectable post-exploitation stages (credential harvesting, persistence, cryptomining) reported by Microsoft TI — pull the blog post for IOCs, then hunt for anomalous processes and outbound connections on any hosts running AI gateway software since the publication date.
  • Leader — Plan: AI workloads are now an established attack surface for credential theft and resource abuse; this quarter, ensure AI infrastructure (gateways, API proxies, GPU hosts) is included in your hardening and access-review scope alongside traditional edge assets.