Weekly CISO Digest — Week of 2026-10-09: FortiGate Devices Under Siege

Headline Incident: FortiBleed Attackers Compromise Over 80,000 FortiGate Devices Globally

A coordinated FortiBleed campaign has compromised more than 80,000 FortiGate firewall devices worldwide, according to the FBI. Attackers used stolen credentials and unauthorized account creation to gain persistent access, with the ability to lock out legitimate administrators by deleting or changing passwords. The campaign has enabled lateral movement within victim environments and facilitated access rental to ransomware affiliates, including INC/Lynx and Payload groups. Over 86,000 internet-facing Fortinet firewalls are impacted, with credential stuffing and password spraying as primary attack vectors. Organizations using FortiGate devices globally are at risk and must immediately audit admin accounts, rotate credentials, and apply available mitigations.

This Week's Incidents

Seizure of NudeLeaksTeens site distributing hacked intimate images of 17,000 victims

What: The FBI and French authorities seized the NudeLeaksTeens site, which sold hacked explicit images and PII of over 17,000 women and girls, including child sexual abuse material.
Who's at risk: Social media users, especially in Europe; organizations handling sensitive user data.
Action: Review data protection controls and monitor for credential leaks.

Data breach at Denmark's national ID system exposes personal data of 8.8 million

What: Attackers exploited legitimate credentials to access Denmark’s National Citizen Registry, harvesting records of 8.8 million people over 10 days.
Who's at risk: Danish citizens and any organization relying on national ID verification.
Action: Monitor for identity fraud and enforce strict credential management for privileged systems.

Attackers hijack ccTLDs to obtain counterfeit TLS certificates for Google and other major services

What: Attackers hijacked .gh, .sl, and .as ccTLD registries, obtaining unauthorized TLS certificates for Google and other global brands.
Who's at risk: Organizations with domains in affected ccTLDs, users of Google and major online services.
Action: Audit certificate transparency logs and revoke suspicious certificates.

ShinyHunters breach of FBI job applicant portals confirmed

What: ShinyHunters exploited an Oracle PeopleSoft zero-day to breach FBI job applicant portals, stealing personnel files and sensitive medical data.
Who's at risk: US federal agencies, government HR platforms, Oracle PeopleSoft users.
Action: Patch Oracle PeopleSoft immediately and review access to sensitive HR systems.

Palo Alto GlobalProtect VPN Exploited by Ransomware (CVE-2026-0257)

What: Ransomware actors exploited CVE-2026-0257, an authentication bypass in Palo Alto GlobalProtect and Prisma Access, to hijack VPN sessions.
Who's at risk: Organizations using Palo Alto VPN products globally.
Action: Apply the latest security patch for CVE-2026-0257 without delay.

AI-assisted AitM spear-phishing campaign targets Taiwan research organizations

What: An APT group used AI-generated spear-phishing and adversary-in-the-middle (AitM) frameworks to target Taiwan research institutions, intercepting credentials and MFA.
Who's at risk: Academic and research organizations, especially in Taiwan.
Action: Train staff on advanced phishing and enforce phishing-resistant MFA.

YouTubers targeted by phishing campaigns impersonating brands for Google account hijacking

What: Phishing campaigns impersonated brands like Nike and Spotify to steal Google credentials from YouTube creators, compromising Gmail, Drive, and channels.
Who's at risk: Social media influencers, content creators, and anyone with Google accounts.
Action: Warn users about brand impersonation scams and enable robust 2FA.

UAC-0099 malware MATCHBOIL installs spying backdoor on Ukrainian transport, manufacturing, and energy companies

What: Russia-aligned UAC-0099 deployed MATCHBOIL malware via spear phishing, installing the MATCHWOK backdoor on Ukrainian critical infrastructure.
Who's at risk: Ukrainian transport, manufacturing, and energy sectors.
Action: Hunt for MATCHBOIL/MATCHWOK indicators and strengthen phishing defenses.

Web3-powered Cloud Supply Chain Attacks by DPRK-affiliated Actors

What: DPRK actors used Web3-powered supply chain attacks (ChainDrop, PolinRider) to infect open-source packages and steal cloud credentials from CI/CD pipelines.
Who's at risk: Organizations using npm, Go modules, Packagist, and cloud developer tools.
Action: Audit dependencies and monitor for suspicious smart contract C2 activity.

Blinder Tunnel Campaign Targets Iraqi Infrastructure

What: Iranian threat actors used social engineering and custom malware (ShelbyLoader V2) to compromise Iraqi critical infrastructure via trojanized coding challenges.
Who's at risk: Middle Eastern critical infrastructure, especially in Iraq.
Action: Restrict developer file execution and monitor for GitHub API C2 traffic.

Phishing Campaign Abuses Action1 RMM Tool to Deploy Malware

What: Malicious PDF invoices led to installation of trojanized Action1 RMM agents, granting attackers persistent remote access via cloud infrastructure.
Who's at risk: Organizations using remote management tools and cloud services.
Action: Block suspicious VBS/MSI downloads and review RMM agent deployments.

Google Ads Used to Deliver Malware via Fake ChatGPT Custom GPT Scam

What: Attackers abused Google Ads to deliver malware via fake ChatGPT custom GPTs, tricking users into executing PowerShell commands.
Who's at risk: Google users, especially those searching for AI tools.
Action: Educate staff on ad-based phishing and restrict PowerShell execution.

Cyberattack Disrupts South African Air Traffic Control

What: A cyberattack caused widespread disruption to South African air traffic control, delaying flights and prompting safety protocol reviews.
Who's at risk: African aviation sector and critical infrastructure providers.
Action: Test DDoS resilience and update incident response plans for operational tech.

This Week's Pattern

• Credential theft and abuse are central to multiple incidents, including FortiGate, Denmark’s ID registry, and FBI portals, highlighting the urgent need for privileged access audits and credential hygiene.
• Supply chain and infrastructure attacks are rising, with Web3-powered malware campaigns and ccTLD hijacks enabling attackers to bypass traditional perimeter defenses.
• State-aligned APTs continue to target critical sectors—energy, transport, and government—using spear phishing, malware, and social engineering, underscoring the need for layered defense and rapid incident response.