SOCRadar published a comprehensive technical and attribution report today on FortiBleed, confirming it is a financially motivated Russian initial access broker operation. The report names the actor as a known Russian-speaking IAB who has been operating FortiBleed since at least February 2026 and has been identified in prior campaigns targeting network infrastructure. The scope has expanded from the 86,644 verified device credentials reported on June 19 to cover over 430,000 FortiGate firewalls identified as within the operation’s scanning scope, with 80,000 positively identified as targets and more than 19,000 still being actively sniffed as of today.
The operation is confirmed multi-vendor. While the majority of targets are Fortinet devices, the same methodology has been observed against other exposed firewall and network appliance products. SOCRadar describes a four-stage operation: Masscan and Shodan are used to discover exposed management interfaces; SSH brute-force attacks are conducted against devices, with default and factory credentials succeeding on the majority of initial compromises as documented in Issue 68; FortigateSniffer is deployed on compromised devices to passively capture authentication traffic using the legitimate FortiOS diagnostic command; and captured credential hashes are exfiltrated, cracked using GPU clusters, validated, and sold on criminal forums as access packages for downstream buyers.
The report notes that stolen session cookies provide persistent access that survives password rotation unless sessions are explicitly invalidated at the server side, and that FortigateSniffer blends into normal FortiOS activity, making it difficult to detect through standard authentication log monitoring alone. MSPs and IT services firms managing Fortinet devices on behalf of clients are specifically identified as high-value targets whose compromise creates downstream exposure for all of their managed clients.
- Apply the latest FortiGate firmware, rotate all administrator and VPN user credentials, and explicitly invalidate all active sessions rather than relying on password rotation alone. Active sessions survive password changes unless terminated server-side.
- Audit FortiGate for the presence of unexpected diagnostic processes or scheduled tasks, and review outbound connections from FortiGate devices for unexpected traffic, since FortigateSniffer uses a legitimate diagnostic command that may not trigger standard alerts.
- For MSPs managing Fortinet environments for multiple clients, treat a compromised device as a potential pivot point into all managed client networks and conduct expanded incident response accordingly.
- Monitor for lateral movement indicators within the network perimeter, since access sold by an IAB may have already been purchased and used before this report was published.
Defused reported today that its honeypot network has detected exploitation attempts against Cisco Unified CM targeting CVE-2026-20230. The exploitation activity observed appears focused on scanning for vulnerable instances by attempting to write a test file, /tmp/cve-2026-20230-test.txt, to confirm the file write primitive is accessible. SSD Secure published a full technical write-up today explaining the exploitation chain in detail.
CVE-2026-20230 is a server-side request forgery vulnerability in the Cisco Unified CM WebDialer component. WebDialer is a browser-based click-to-dial service that allows users to initiate calls from directory pages. It ships disabled by default but is commonly enabled in enterprise Unified CM deployments. The flaw exists because WebDialer improperly validates user-supplied URLs in certain HTTP requests. An attacker can supply a crafted file:// URI that causes the WebDialer process to open a file path on the underlying operating system and write attacker-controlled content to it. Because the WebDialer process runs with elevated privileges, the file write can target sensitive system paths. Cisco confirmed in its June 3 advisory that files written through this mechanism can later be used to escalate to root.
Cisco first patched the vulnerability on June 3, 2026, and confirmed at the time that public proof-of-concept exploit code was already available. Cisco’s PSIRT stated no malicious exploitation had been detected at that date. The gap between PoC publication and confirmed exploitation was approximately three weeks, consistent with the exploitation timeline seen on previous high-profile Cisco vulnerabilities. This is the third significant privilege-escalation vulnerability in Cisco Unified CM in roughly two years, following CVE-2024-20253 in January 2024 and CVE-2026-20045, which was actively exploited as a zero-day before a patch was available, in January 2026.
- Patch Cisco Unified CM and Unified CM SME to Release 14SU6 or Release 15SU5. Apply the available COP file for Release 15 environments as an interim step if the full update cannot happen immediately.
- If patching is delayed, disable the WebDialer service immediately. Exploitation is gated on WebDialer being enabled, and disabling it removes the attack surface entirely without requiring a maintenance window.
- Audit any Unified CM instance where WebDialer was enabled and network-accessible since June 3 for unexpected files in /tmp, webshell patterns in web application directories such as .jsp and .php files, and unexpected scheduled tasks or background processes.
SecurityWeek reported today that at least nine organizations have publicly confirmed that data was stolen from their Salesforce instances through the Klue Battlecards integration, including multiple cybersecurity vendors. Klue issued a formal statement on Friday confirming the full scope of what occurred and publicly acknowledging legacy credentials as the entry point for the first time.
Klue said the attacker used compromised legacy credentials to gain access to its systems on June 11 and 12, then collected OAuth tokens connecting Klue to Salesforce and other third-party platforms for a number of customer environments. The company revoked the affected credentials and tokens, disabled the relevant integrations, and is working with CrowdStrike to investigate the incident. Law enforcement has also been engaged. Klue stated it has been notifying affected customers and will continue to do so as its investigation progresses.
The extortion group Icarus’s stated June 22 deadline for data publication or negotiations has passed. As of today, the full stolen dataset has not been confirmed as publicly released, though Icarus has previously stated responsibility for the attack on its Tor-based leak site. The investigation and victim scope remain active and ongoing.
- Audit Salesforce API logs for the period June 11 to 17 for the indicators documented in Issue 67: unusual query volumes from Klue service accounts, Python-urllib user-agent strings, and bulk record access patterns. Do not wait for Klue to confirm your organization was impacted before conducting this review.
- Revoke and rotate all Salesforce OAuth tokens and connected app credentials for the Klue integration if not already completed.
- Audit other third-party platforms connected to Klue in your environment beyond Salesforce, since Klue’s statement confirms the attacker collected OAuth tokens for multiple connected platforms, not only Salesforce.