FortiBleed Exposes 75,000 Firewalls: What State Government CISOs Must Do Right Now

Public Sector

Published on

June 18, 2026

Table of Contents

Threat Assessment Level: ELEVATED (Raised from GUARDED — driven by the FortiBleed credential exposure campaign and compounding unpatched zero-day risk) <h2> Executive Summary </h2> A Russian-speaking threat group has extracted working administrator credentials from approximately 75,000 Fortinet FortiGate firewalls worldwide — including confirmed government agencies. Simultaneously, a Windows Defender privilege escalation zero-day (CVE-2026-50656) remains unpatched with a public exploit circulating for eight days, and critical NGINX vulnerabilities enable remote code execution on citizen-facing web infrastructure. For state government IT leaders, these three developments create a fully-enabled attack chain: perimeter credential theft → endpoint privilege escalation → ransomware deployment. Active ransomware groups (Qilin, Play, Krybit, Gunra) were all updated this week and are positioned to exploit exactly this combination. This is not theoretical. Murray County, Georgia paid a $200,000 ransom on June 16 after a ransomware attack encrypted tax, court, and law enforcement systems — including backups. Your state could be next. <h2> What Changed </h2> The past 72 hours introduced a convergence of threats that individually warrant attention but together represent a compounding crisis: <ul> <li> FortiBleed (June 17–18): A productized credential catalog — not a traditional breach — containing admin passwords for ~75,000 FortiGate devices across 194 countries, enriched with business intelligence metadata (industry, revenue, employee count) and formatted for eCrime marketplace sales. A 45-GPU cracking cluster processed 1.16 billion credential attempts against 320,777 targets. </li> <li> CVE-2026-50656 "RoguePlanet" (Day 8 unpatched): A TOCTOU race condition in Microsoft Defender's file-processing workflow enables SYSTEM-level privilege escalation on all Windows 10/11 endpoints. Public proof-of-concept by "Nightmare Eclipse" has been circulating since June 10. Microsoft has acknowledged but released no fix. </li> <li> F5 NGINX Critical RCE (June 18): Out-of-band patches for CVE-2026-42530 (HTTP/3 use-after-free) and CVE-2026-42055 (heap overflow) enabling unauthenticated remote code execution. F5 also disclosed that state-backed attackers breached F5 systems in August 2025, stealing BIG-IP source code. </li> <li> 5 Rockwell Automation ICS Advisories (June 16): Including account takeover on FLEX I/O EtherNet/IP adapters used in water treatment and energy SCADA environments. </li> <li> Oracle PeopleSoft Mass Exploitation (June 12–present): ShinyHunters/UNC6040 began exploiting CVE-2026-35273 as a zero-day on June 12, compromising approximately 100 organizations in five days. State HR and finance PeopleSoft instances managing payroll for tens of thousands of employees are confirmed high-value targets. </li> <li> Nation-State Pre-Positioning: APT29 (Russia SVR) is running an active cloud campaign against government targets (June 16); China-nexus actors are conducting IIS exploitation (June 17); Sandworm/Electrum IOCs were updated June 18; UNC5435 (Russia-nexus) is running a Signal phishing campaign against government personnel (June 16); and VOID MANTICORE/Handala (IRGC-affiliated) confirmed a breach of California water utilities on June 12. </li> <li> Ransomware operators active: Qilin confirmed targeting government sector (June 8 spree), Play and Krybit updated June 17, Gunra updated June 12. </li> </ul> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Impact </th> </tr> </thead> <tbody> <tr> <td> May 13, 2026 </td> <td> Murray County, GA ransomware attack encrypts tax, court, and law enforcement systems </td> <td> County operations paralyzed; backups destroyed </td> </tr> <tr> <td> Jun 8, 2026 </td> <td> Qilin ransomware spree confirmed (ZeroFox) </td> <td> Government sector targeting continues </td> </tr> <tr> <td> Jun 10, 2026 </td> <td> CVE-2026-50656 "RoguePlanet" PoC published </td> <td> Every Windows endpoint vulnerable to LPE </td> </tr> <tr> <td> Jun 12, 2026 </td> <td> ShinyHunters/UNC6040 mass exploitation of Oracle PeopleSoft (CVE-2026-35273) begins </td> <td> ~100 organizations compromised in 5 days </td> </tr> <tr> <td> Jun 12, 2026 </td> <td> Handala/VOID MANTICORE breaches California water utilities </td> <td> IRGC-affiliated actor targeting U.S. critical infrastructure </td> </tr> <tr> <td> Jun 16, 2026 </td> <td> Murray County pays $200,000 ransom </td> <td> Demonstrates state/local government willingness to pay </td> </tr> <tr> <td> Jun 16, 2026 </td> <td> CISA adds CVE-2026-48907 to KEV (active exploitation) </td> <td> Product details pending NVD publication </td> </tr> <tr> <td> Jun 16, 2026 </td> <td> CISA publishes 5 Rockwell ICS advisories </td> <td> Water/energy SCADA at risk </td> </tr> <tr> <td> Jun 17, 2026 </td> <td> FortiBleed dataset surfaces publicly </td> <td> 75,000 FortiGate admin credentials exposed </td> </tr> <tr> <td> Jun 17, 2026 </td> <td> Play, Krybit ransomware groups update operations </td> <td> Active targeting posture confirmed </td> </tr> <tr> <td> Jun 18, 2026 </td> <td> F5 NGINX critical RCE patches released (CVE-2026-42530, CVE-2026-42055) </td> <td> Citizen-facing web apps exposed </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. FortiBleed: The Largest Credential Exposure of 2026 </h3> This is not a vulnerability — it's an industrialized access-broker operation. The threat group extracted plaintext admin credentials from FortiGate device configurations, cracked hashed passwords using a 45-GPU cluster, and packaged the results as a curated sales catalog for ransomware operators and nation-state actors. Why state government is at elevated risk: <ul> <li> Fortinet FortiGate is standard procurement across state agencies </li> <li> The dataset includes government agencies by name </li> <li> Credentials are formatted with industry/revenue metadata — government targets are explicitly tagged </li> <li> Access brokers sell to ransomware operators who specifically target state/local government for media attention and weak security budgets </li> </ul> Relevant ATT&CK techniques: T1078 (Valid Accounts), T1552.001 (Credentials in Files), T1110.002 (Password Cracking), T1133 (External Remote Services) <h3> 2. CVE-2026-50656 "RoguePlanet": The Unpatched Escalation Path </h3> With FortiBleed providing initial access and RoguePlanet providing privilege escalation, ransomware operators have a complete kill chain requiring zero custom tooling. The PoC is reliable, automated retry mechanisms are being developed by the community, and Microsoft has provided no patch timeline. CVSS: 7.8 | CWE: CWE-362 (Race Condition) Affected: All fully-patched Windows 10 and Windows 11 endpoints <h3> 3. Nation-State Pre-Positioning Continues </h3> Active campaigns this cycle include: <ul> <li> WARLORD KITTEN / Handala / VOID MANTICORE (IRGC-affiliated, Iran) — confirmed breach of California water utilities </li> <li> APT29 (Russia SVR) — active cloud campaign targeting government (June 16) </li> <li> China-nexus — IIS exploitation campaign (June 17) </li> <li> Sandworm/Electrum (Russia GRU) — active IOCs updated June 18 </li> <li> UNC5435 (Russia-nexus) — Signal phishing campaign targeting government personnel (June 16) </li> </ul> Critical absence: Volt Typhoon / Salt Typhoon activity is not detected this cycle. Given their documented pre-positioning in U.S. critical infrastructure, silence should prompt proactive hunting — not reassurance. <h3> 4. Oracle PeopleSoft Under Active Mass Exploitation </h3> ShinyHunters/UNC6040 exploited CVE-2026-35273 as a zero-day beginning June 12, compromising approximately 100 organizations in five days. State HR/Finance PeopleSoft instances managing payroll for 50,000+ employees are high-value targets. The June 2026 Critical Patch Update addresses 243 CVEs. <h3> 5. ICS/SCADA: Accelerating Vulnerability Discovery </h3> Five Rockwell Automation advisories in a single batch — the third consecutive cycle with Rockwell vulnerabilities. The FLEX I/O EtherNet/IP account takeover vulnerability is particularly concerning for water treatment and energy SCADA environments where these adapters control physical processes. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> FortiBleed credentials appear on eCrime forums, triggering opportunistic attacks against unrotated credentials </td> <td> 70% </td> <td> 48 hours </td> <td> Dataset is formatted as sales catalog; access-broker monetization patterns </td> </tr> <tr> <td> CVE-2026-50656 exploitation observed in the wild </td> <td> 50% </td> <td> 7 days </td> <td> Public PoC, no patch, high reliability, low complexity </td> </tr> <tr> <td> State government entity targeted via FortiBleed credentials </td> <td> 30% </td> <td> 7 days </td> <td> Government agencies confirmed in dataset; ransomware operators actively seeking government targets </td> </tr> <tr> <td> Ransomware deployment leveraging FortiBleed + RoguePlanet chain </td> <td> 40% </td> <td> 14 days </td> <td> All components available; Qilin/Play/Krybit actively targeting government </td> </tr> <tr> <td> NGINX RCE exploitation against government web infrastructure </td> <td> 25% </td> <td> 14 days </td> <td> Requires non-default config (HTTP/3); state adoption of QUIC is limited but growing </td> </tr> <tr> <td> Rockwell ICS exploitation in water/energy environment </td> <td> 20% </td> <td> 30 days </td> <td> Advisories just published; exploitation requires network access to OT segment </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> Priority </th> <th> What to Monitor </th> <th> ATT&CK ID </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> FortiGate admin logins from unexpected IPs/times </td> <td> T1078 </td> <td> Alert on admin authentication from non-whitelisted source IPs; correlate with FortiBleed exposure check </td> </tr> <tr> <td> CRITICAL </td> <td> Rapid file-substitution in Defender scan paths </td> <td> T1068 </td> <td> Monitor C:\ProgramData\Microsoft\Windows Defender\Scans\ for rapid file creation/deletion patterns; alert on unexpected SYSTEM process spawning from Defender workers </td> </tr> <tr> <td> HIGH </td> <td> New admin accounts on FortiGate devices </td> <td> T1136.001 </td> <td> Audit FortiGate local user database for accounts created since January 2026 </td> </tr> <tr> <td> HIGH </td> <td> LSASS memory access post-RoguePlanet </td> <td> T1003.001 </td> <td> Enhanced LSASS protection monitoring; alert on non-standard processes accessing LSASS </td> </tr> <tr> <td> HIGH </td> <td> Anomalous M365 Copilot cross-application queries </td> <td> T1530 </td> <td> Review Copilot audit logs for bulk data retrieval spanning email + SharePoint + OneDrive in single session </td> </tr> <tr> <td> MODERATE </td> <td> External Remote Services on FortiGate </td> <td> T1133 </td> <td> Audit VPN/SSL-VPN sessions for credential reuse patterns; look for simultaneous sessions from geographically impossible locations </td> </tr> <tr> <td> MODERATE </td> <td> Living-off-the-land on edge devices </td> <td> T1059 </td> <td> Hunt for unexpected CLI commands, scheduled tasks, or firmware modifications on Cisco/Fortinet/Palo Alto devices </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> "Has FortiBleed already been used against us?" — Query FortiGate admin authentication logs for successful logins from unrecognized IPs since January 2026. Cross-reference with any new admin accounts, firewall rule modifications, or VPN tunnel creations during non-business hours. </li> <li> "Is Volt Typhoon pre-positioned on our edge devices?" — Hunt for living-off-the-land indicators on Cisco and Fortinet perimeter devices: unexpected scheduled tasks, modified firmware images, unusual outbound connections from management interfaces, or configuration changes not matching change management tickets. </li> <li> "Has RoguePlanet been weaponized in our environment?" — Search EDR telemetry for processes interacting with Windows Defender scan directories at high frequency, particularly any non-Defender process writing to C:\ProgramData\Microsoft\Windows Defender\Scans\. Look for unexpected SYSTEM-level cmd.exe or PowerShell spawning from MsMpEng.exe or related Defender service processes. </li> <li> "Are our PeopleSoft instances compromised?" — Audit Oracle PeopleSoft web server logs for exploitation patterns matching CVE-2026-35273. Review database audit logs for unauthorized data exports from HR/payroll tables since June 12. </li> </ol> <h3> Blocking Guidance </h3> <ul> <li> Block management interface access to FortiGate devices from all external IPs immediately </li> <li> Implement conditional access policies requiring hardware tokens for all network device administration </li> <li> If NGINX HTTP/3 (QUIC) is enabled on citizen-facing applications, disable it pending patching or apply vendor patches immediately </li> </ul> For specific network IOCs (IPs, domains, hashes) associated with the campaigns discussed in this report, refer to Anomali ThreatStream Next-Gen for the latest indicators. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Tax Systems, Benefits Processing) </h3> <ul> <li> Primary threat: FortiBleed credentials enabling access to financial transaction systems; ransomware targeting tax processing during fiscal year-end </li> <li> Priority action: Verify FortiGate devices protecting treasury/tax network segments are not in the FortiBleed dataset; rotate all privileged credentials on financial systems; ensure Oracle PeopleSoft financial modules are patched against CVE-2026-35273 </li> <li> Detection focus: Anomalous database queries against tax records, bulk PII export, unauthorized ACH/wire transfer configurations </li> </ul> <h3> Energy (State-Managed Utilities, Grid Operations) </h3> <ul> <li> Primary threat: Rockwell FLEX I/O account takeover (ICSA-26-167-05) in SCADA environments; IRGC-affiliated actors (VOID MANTICORE) demonstrated capability against U.S. water utilities </li> <li> Priority action: Patch FLEX I/O EtherNet/IP adapters immediately; verify IT/OT network segmentation prevents lateral movement from compromised FortiGate to SCADA networks; audit remote access to energy management systems </li> <li> Detection focus: Unauthorized CIP protocol commands to Logix controllers, new accounts on FLEX I/O adapters, anomalous traffic crossing IT/OT boundaries </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Primary threat: Ransomware operators (Qilin, Play) actively targeting healthcare-adjacent government systems; PeopleSoft HR systems containing employee health data </li> <li> Priority action: Validate backup integrity for Medicaid claims processing systems; ensure RoguePlanet detection is deployed on clinical and administrative endpoints; review third-party vendor access to health data systems </li> <li> Detection focus: Encryption activity on file shares containing PHI, lateral movement from compromised endpoints to Medicaid databases, unauthorized access to benefits eligibility systems </li> </ul> <h3> Government (Executive Branch Agencies, Law Enforcement) </h3> <ul> <li> Primary threat: The Murray County attack demonstrates that law enforcement systems are explicitly targeted; FortiBleed provides the initial access vector; nation-state actors (APT29, China-nexus) conducting espionage against government personnel </li> <li> Priority action: Emergency FortiGate credential rotation across all agencies; deploy RoguePlanet detection on all domain-joined endpoints; brief agency heads on Signal phishing campaign (UNC5435) targeting government personnel </li> <li> Detection focus: Admin account creation on network devices, VPN connections from unusual geographies, bulk email/document access via compromised credentials, anomalous Copilot queries accessing cross-agency data </li> </ul> <h3> Aviation/Logistics (State DOT, Airport Authorities, Port Systems) </h3> <ul> <li> Primary threat: Volt Typhoon pre-positioning in transportation infrastructure; Rockwell CompactLogix DoS vulnerabilities affecting traffic management and port control systems </li> <li> Priority action: Patch CompactLogix controllers in traffic management systems; conduct proactive hunt for living-off-the-land activity on edge networking equipment at DOT facilities; verify segmentation between corporate IT and operational traffic management networks </li> <li> Detection focus: Unexpected firmware updates on traffic controllers, anomalous DNS queries from OT segments, unauthorized remote access to transportation SCADA systems </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Action </th> <th> Responsible Team </th> </tr> </thead> <tbody> <tr> <td> Verify all state FortiGate devices against the FortiBleed exposure dataset. If ANY state domains appear, rotate ALL admin credentials within 4 hours and audit for unauthorized accounts created since January 2026. </td> <td> IT Operations / Network Security </td> </tr> <tr> <td> Disable internet-facing FortiGate management interfaces. Enforce MFA on all FortiGate admin accounts. Force admin re-login to trigger PBKDF2 credential storage migration. </td> <td> IT Operations </td> </tr> <tr> <td> Deploy EDR detection rules for RoguePlanet exploitation patterns: rapid file operations in Defender scan paths and unexpected SYSTEM process creation from Defender worker processes. </td> <td> SOC </td> </tr> <tr> <td> Brief executive leadership: FortiBleed may constitute an active compromise of state perimeter infrastructure. Request emergency maintenance window approval for credential rotation. </td> <td> CISO </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Action </th> <th> Responsible Team </th> </tr> </thead> <tbody> <tr> <td> Audit all NGINX deployments on citizen-facing web infrastructure. Patch to latest version or disable HTTP/3 (QUIC) by removing 'quic' from listen directives. Verify ASLR is enabled on all NGINX hosts. </td> <td> IT Operations / Web Infrastructure </td> </tr> <tr> <td> Apply Rockwell firmware updates for Logix 5370/5570, RSLinx, FLEX I/O, CompactLogix, and FactoryTalk Analytics PavilionX. Prioritize FLEX I/O in water/energy SCADA. </td> <td> OT/ICS Team </td> </tr> <tr> <td> Validate M365 Copilot Enterprise Search data access boundaries. Review Copilot audit logs for anomalous cross-application data retrieval. </td> <td> Cloud Security / Identity Team </td> </tr> <tr> <td> Conduct proactive threat hunt for Volt Typhoon living-off-the-land indicators on all Cisco, Fortinet, and Palo Alto edge devices. </td> <td> SOC / Threat Hunting </td> </tr> <tr> <td> Verify Oracle PeopleSoft patching status against CVE-2026-35273. If unpatched, apply June 2026 Critical Patch Update immediately. </td> <td> Database/ERP Team </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Action </th> <th> Responsible Team </th> </tr> </thead> <tbody> <tr> <td> Commission assessment of state exposure to the access-broker ecosystem. Evaluate zero-trust architecture acceleration for all internet-facing management planes. </td> <td> CISO / Enterprise Architecture </td> </tr> <tr> <td> Implement certificate-based or hardware-token authentication for all network device administration, eliminating password-based admin access to perimeter devices. </td> <td> Identity & Access Management </td> </tr> <tr> <td> Accelerate IT/OT network segmentation program. Three consecutive cycles of Rockwell advisories indicate systemic vulnerability patterns requiring architectural mitigation. </td> <td> OT Security / Network Architecture </td> </tr> <tr> <td> Evaluate AI-layer security controls: treat M365 Copilot and similar AI assistants as privileged identities requiring access controls, logging, and anomaly detection equivalent to domain admin accounts. </td> <td> Cloud Security / CISO </td> </tr> <tr> <td> Develop and tabletop an incident response playbook specifically for "perimeter device credential mass compromise" — the FortiBleed scenario will recur with other vendors. </td> <td> IR Team / CISO </td> </tr> </tbody> </table> <h2> Bottom Line </h2> What makes this moment dangerous is not any single vulnerability — it's the convergence. FortiBleed gives attackers the front door key. RoguePlanet gives them SYSTEM privileges once inside. Active ransomware groups (Qilin, Play, Krybit, Gunra) are positioned to weaponize both within days. And the Murray County attack proves that state and local government systems — including law enforcement and courts — are explicitly on the target list. The access-broker ecosystem has industrialized. Credentials are no longer stolen one at a time — they're harvested at scale, enriched with targeting metadata, and sold to the highest bidder. Your FortiGate admin password may already be in a shopping cart. The window to act is measured in hours, not days. Verify your exposure. Rotate your credentials. Hunt for evidence of compromise. The threat actors already have their catalog — the only question is whether your organization is in it, and whether you'll find out from your SOC or from a ransom note. <h2> IOC Reference </h2> IOCs for the campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and partner feeds. The FortiBleed exposure dataset can be checked via the Hudson Rock lookup tool. CISA ICS advisories (ICSA-26-167-01 through ICSA-26-167-05) contain technical details for Rockwell vulnerabilities. Key CVEs referenced in this report: <table> <thead> <tr> <th> CVE </th> <th> Product </th> <th> Status </th> <th> Severity </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-50656 </td> <td> Microsoft Windows Defender </td> <td> UNPATCHED — PoC public </td> <td> 7.8 (High) </td> </tr> <tr> <td> CVE-2026-42530 </td> <td> F5 NGINX (HTTP/3) </td> <td> Patch available June 18 </td> <td> Critical (RCE) </td> </tr> <tr> <td> CVE-2026-42055 </td> <td> F5 NGINX (proxy_v2/grpc) </td> <td> Patch available June 18 </td> <td> Critical (RCE) </td> </tr> <tr> <td> CVE-2026-48907 </td> <td> TBD (CISA KEV) </td> <td> Active exploitation confirmed </td> <td> TBD </td> </tr> <tr> <td> CVE-2026-35273 </td> <td> Oracle PeopleSoft </td> <td> Patch available (June CPU) </td> <td> Critical (mass exploitation) </td> </tr> <tr> <td> CVE-2026-11311 </td> <td> F5 NGINX </td> <td> Patch available </td> <td> High </td> </tr> <tr> <td> CVE-2026-50107 </td> <td> F5 NGINX </td> <td> Patch available </td> <td> High </td> </tr> </tbody> </table> Published June 18, 2026 | Anomali CTI Desk For questions or to request additional analysis, contact your Anomali account team.

FEATURED RESOURCES

June 18, 2026

Anomali Cyber Watch

Iranian Cyber Forces Converge: Access Brokers Now Sharing Tooling with Destructive Operators

June 18, 2026

Anomali Cyber Watch

Public Sector

FortiBleed Exposes 75,000 Firewalls: What State Government CISOs Must Do Right Now

June 17, 2026

Anomali Cyber Watch

Iranian Cyber Operations Intensify as Conflict Enters Day 110: SD-WAN Kill Chains, ICS Vulnerabilities, and Supply Chain Compromise Converge

Explore All