Real-life Cyberattacks Cases

In June 2026, security researchers uncovered one of the largest credential-compromise events ever documented against network perimeter devices. A large-scale, fully automated operation, later named FortiBleed, had been quietly targeting Fortinet firewalls and VPN gateways, compromising more than 30,000 internet-facing devices across nearly 200 countries.

The campaign was first spotted by independent security consultant Volodymyr Diachenko and analysed in depth by the threat intelligence firm SOCRadar, which discovered an exposed operational server belonging to the attackers. That server handed researchers a rare inside view: the group's tooling, automation scripts and a verified database holding working login credentials for more than 30,791 devices spanning 194 countries.

The most alarming detail is what the campaign did not involve. There was no zero-day, no novel exploit and no software vulnerability. The operation ran on a simple, brutal premise: a curated list of passwords already leaked in earlier Fortinet incidents, fired back at organisations that had never changed them. Many of the compromised accounts were generic administrator logins, default or built-in system accounts, or long-lived credentials that had never been rotated after a previous breach.

What made FortiBleed so effective was its self-sustaining design. Automated tools continuously scanned the internet for exposed Fortinet devices and tested them against the credential list. Each successful login was recorded, and the compromised device was then turned into a listening post, capturing additional credentials flowing through it. Those freshly harvested passwords were fed straight back into the scanner, allowing the operation to compromise ever more devices with no human at the keyboard.

The footprint cut across every critical sector. The verified victims spanned 21,108 unique IP addresses and 8,316 unique domains, reaching organisations in government, telecommunications, healthcare, education, financial services and critical infrastructure. Researchers rated the threat critical and warned that any organisation appearing in the dataset should treat its network perimeter as already compromised.