threat-intel FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations A large-scale credential theft campaign, dubbed FortiBleed, has been linked to both the INC and Lynx ransomware groups, utilizing stolen Fortinet credentials for follow-on intrusions. The operation involved extensive scanning and exploitation of vulnerable FortiGate firewalls, resulting in numerous ransomware deploymen… The Hacker News · Jul 2, 2026 High CVE-2026-35616USLAAScredential theftransomwarefortinet
vulnerability 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs Recent analysis reveals that three previously patched Fortinet FortiSandbox vulnerabilities – CVE-2026-39808, CVE-2026-39813, and CVE-2026-25089 – are actively being exploited in the wild. A significant number of comprom… SecurityWeek · Jun 17, 2026 High CVE-2026-39808CVE-2026-39813CVE-2026-25089USINALvulnerabilitypatchingexploitation
vulnerability Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week Bad actors are exploiting multiple security vulnerabilities in Fortinet FortiSandbox, according to threat intelligence firm Defused Cyber. In a post shared on X, the company said it has observed exploitation of CVE-2026-… The Hacker News · Jun 16, 2026 Medium CVE-2026-39813CVE-2026-39808CVE-2026-25089
threat-intel China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance A China-linked botnet, dubbed JDY, has significantly expanded its operations, now comprising over 1,500 compromised SOHO and IoT devices. Initially a component of the KV-botnet, the JDY botnet is being used for large-sca… The Hacker News · Jun 10, 2026 High CVE-2026-35616USBRDEiotreconnaissancebotnet
threat-intel China-linked JDY botnet expands targeting of U.S. military networks A Chinese-linked botnet, JDY, has significantly expanded its targeting of U.S. military networks and associated infrastructure. The botnet, previously associated with Volt Typhoon, utilizes reconnaissance techniques like… BleepingComputer · Jun 10, 2026 High CVE-2026-35616USbotnetreconnaissanceapt
vulnerability PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation Palo Alto Networks has warned that a recently disclosed medium-severity security flaw impacting PAN-OS and Prisma Access has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-0257 (CVSS s… The Hacker News · May 30, 2026 Medium CVE-2026-0257CVE-2026-35616
vulnerability Hackers exploit FortiClient EMS flaw to push infostealer malware Hackers are exploiting an authentication bypass vulnerability (CVE-2026-35616) in FortiClient Enterprise Management Server (EMS) to deliver an undocumented credential stealer called EKZ. BleepingComputer · May 28, 2026 Medium CVE-2026-35616
vulnerability Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer Threat actors are continuing to exploit a critical, now-patched security flaw impacting FortiClient Endpoint Management Server (EMS) deployments to deliver credential-stealing malware. "The campaign abused trusted endpoi… The Hacker News · May 28, 2026 Medium CVE-2026-35616
vulnerability Critical FortiClient EMS Vulnerability Exploited in Fresh Attacks Fortinet rolled out hotfixes for the security defect in April, warning that it had been exploited in the wild as a zero-day and urging immediate patching. The post Critical FortiClient EMS Vulnerability Exploited in Fres… SecurityWeek · May 28, 2026 Critical CVE-2026-35616
