u/socradario

Breaking: Our Threat Research Team has linked the FortiBleed threat actor to the Lynx / INC ransomware group following extensive technical analysis and continuous monitoring.

If you manage Fortinet gear, grab a coffee. You're going to need it. ☕

Our Threat Research team just published a massive teardown of a Russian compromise operation we’re tracking as FortiBleed. Active since at least February 2026, these threat actors aren't just doing simple smash-and-grabs—they’ve built a highly automated, industrialized credential-harvesting machine.

There is a special kind of irony when your firewall is the exact thing stealing your data. Here is the TL;DR of what we found under the hood:

1. The Weapon: A custom Golang tool called "FortigateSniffer". It literally turns compromised firewalls into passive collectors, sniffing traffic across 24 different authentication protocols.
2. The Scale: Over 430,000 FortiGate firewalls targeted. They ran 659+ harvest cycles, exposing over 110 million credentials (including RADIUS, NTLM, and Kerberos material).
3. The Infrastructure:They aren't playing around. We mapped an isolated Kali VM lab, Hashtopolis and Hashcat GPU clusters, and rented vast(.)ai capacity used to crack hashes at scale.
4. The Victims: The dominant profile is IT services and SMBs (under 200 employees), but they also successfully breached and exfiltrated DFS data from a NATO-aligned defense contractor.

We’ve broken down the complete 5-stage attack chain—from initial recon and brute-force to harvesting, cracking, and exfiltration.

We also dropped all the IoCs and defensive recommendations so you can set up timely alerts and mitigate risks before your network becomes a statistic.

Dive into the full teardown to help strengthen your security posture: https://hubs.la/Q04mc0fJ0

Stay sharp out there. Let us know what you think of the attack chain in the comments. 👇

SOCRadar's Threat Research team found the live operational server of the threat actors behind FortiBleed. Here's a breakdown of the operation's actual scale based on what was recovered:
▸ 80,553 unique compromised Fortigate devices
▸ 59.3M hosts scanned across the internet
▸ ~437K FortiGate devices fingerprinted
▸ 856M+ SSH & 2.1B+ web-panel credential attempts
▸ 105M+ credentials harvested

No zero-day is involved. The attack chain relies entirely on unrotated default credentials and previously leaked passwords — accounts that were never changed after earlier Fortinet incidents.

SOCRadar has released a free checker backed by the most complete dataset assembled around this incident. You can look up any IP block or domain.

🔗 https://socradar.io/free-tools/fortibleed

Immediate recommended actions if you run any internet-facing Fortinet device:
- Rotate all admin and VPN credentials immediately, especially any unchanged since previous Fortinet incidents
- Enable MFA on every admin and remote access account
- Remove FortiGate management interfaces from direct internet exposure
- Review gateway and authentication logs for anomalous access — unusual times, locations, or dormant accounts
- If you appear in the dataset, treat it as a confirmed breach and engage incident response

National CERTs and government cyber agencies can contact research@socradar.com for the full country-level dataset.

There's a new supply chain threat out there. The Shai-Hulud group is back with a "Hades" wave hitting PyPI.

They've trojanized 19 packages across 37 malicious wheels. But the most interesting (and frustrating) part is the execution method: they are using Python startup hooks. This means the malicious code executes just by being installed in the environment—a developer doesn't even have to actually import the package into their code for the payload to trigger.

Once it runs, it goes straight for the good stuff: tokens, cloud creds, SSH keys, and CI secrets.

It’s a stark reminder of how a routine dependency install can easily turn into a massive downstream compromise. One infected dev machine can expose the whole pipeline.

How are you all auditing your Python environments to mitigate this kind of risk? Has anyone caught one of these Hades wheels in their CI/CD yet?

There's a new supply chain threat out there. The Shai-Hulud group is back with a "Hades" wave hitting PyPI.

They've trojanized 19 packages across 37 malicious wheels. But the most interesting (and frustrating) part is the execution method: they are using Python startup hooks. This means the malicious code executes just by being installed in the environment—a developer doesn't even have to actually import the package into their code for the payload to trigger.

Once it runs, it goes straight for the good stuff: tokens, cloud creds, SSH keys, and CI secrets.

It’s a stark reminder of how a routine dependency install can easily turn into a massive downstream compromise. One infected dev machine can expose the whole pipeline.

How are you all auditing your Python environments to mitigate this kind of risk? Has anyone caught one of these Hades wheels in their CI/CD yet?

Today, the pro-Iranian threat group Handala claimed "widespread and targeted signal disruption" of Israeli radar systems, timing the announcement with escalating missile exchanges in the region.

Here is what we know right now:

🔹The Claims:Alongside the radar claims, Handala shared screenshots of what appears to be a Tadiran Telecom Aeonix VoIP admin panel, allegedly belonging to the Kfar Yona municipality. 

🔹 The Actor: The US DOJ officially ties Handala to Iran’s Ministry of Intelligence (MOIS). 

🔹 The Track Record:They are capable of real damage (executing the March 2026 Stryker wiper attack), but they’ve also made highly disputed claims in the past.

As of now, the radar disruption remains unverified with no official response. In the fog of war, relying on verified threat intel and timely alerts is essential to understand the true battlefield and mitigate risk.

Read our full analysis as this developing situation unfolds on our blog.

#ThreatIntelligence #CyberWarfare #Handala #CyberSecurity #Geopolitics

When protocol efficiency becomes your biggest liability. 🚨

The newly detailed "HTTP/2 Bomb" is a masterclass in why default configurations are rarely secure. It effectively turns the speed and design of HTTP/2 into a potent DoS risk.

Here is why this should be on your radar today:
💥 It chains header amplification with a Slowloris-style connection hold.
📉 Attackers can exhaust your server memory using incredibly low bandwidth.
🔓 It impacts several major HTTP/2 stacks in their default setups.
⚠️ Proof-of-Concepts (PoCs) are already out in the wild.

To mitigate this threat and strengthen your posture, defenders need to ask one critical question: Where exactly does HTTP/2 terminate in your architecture, and what limits are actually being enforced at that edge?

Don't wait for your servers to tap out to find the answer. Check our Blog for more details.

When protocol efficiency becomes your biggest liability. 🚨

The newly detailed "HTTP/2 Bomb" is a masterclass in why default configurations are rarely secure. It effectively turns the speed and design of HTTP/2 into a potent DoS risk.

Here is why this should be on your radar today:
💥 It chains header amplification with a Slowloris-style connection hold.
📉 Attackers can exhaust your server memory using incredibly low bandwidth.
🔓 It impacts several major HTTP/2 stacks in their default setups.
⚠️ Proof-of-Concepts (PoCs) are already out in the wild.

To mitigate this threat and strengthen your posture, defenders need to ask one critical question: Where exactly does HTTP/2 terminate in your architecture, and what limits are actually being enforced at that edge?

Don't wait for your servers to tap out to find the answer. Check our Blog for more details.

Everyone is rushing to adopt AI, but the real question is: is your security posture actually ready for the fallout?

The AI Security Roadshow by SOCRadar® Extended Threat Intelligence is officially touching down in Istanbul! 🇹🇷

Join us for a heavy-hitting day of expert intel, deep dives into the AI threat landscape, and networking with the sharpest minds in cyber.

Don't let your latest tech upgrade become a threat actor's playground.

Let's strengthen your defense posture and stay ahead of the curve. 🚀
🗓️ Date: June 18, 2026
📍 Venue: Fairmont Quasar Istanbul

Let’s be real: keeping your skills sharp shouldn't cost an arm and a leg. Enter https://university.socradar.io/ —our learning hub built to help SOC analysts, cyber pros, and students level up their defensive game without draining their wallets.

Whether you're trying to break into the industry or you're a seasoned defender looking to rack up some CPE credits, we’ve got you covered.

What’s the deal?

This isn't just dry theory. We’re serving up actionable insights, dark web deep dives, and practical Cyber Threat Intelligence (CTI) workflows. We focus heavily on the global threat landscape and what threat actors are doing right now.

Why you should care:

💸 100% Free: No hidden paywalls. Keep your credit card in your wallet.

📜 Earn CPE Credits:Rack up 1 to 3 CPEs per course (perfect for ISACA, ISC2, etc.) to keep your CISSP, CISM, Sec+, or other certs active.

🌍 Real-World Tactics: We skip the fluff and focus on the current reality—from initial access brokers to Stealer-as-a-Service.

A few heavy-hitters to get you started:

🕵️ Fundamentals of the Dark Web (1 CPE): Unmask the underground economy, track Telegram stealer channels, and learn how the bad guys actually operate.

🤖 AI Fluency & GenAI Tools for Cyber Pros (3 CPEs): Move past basic prompts. Learn structured human-AI collaboration for threat reports, detection engineering, malware triage, and OSINT.

We’re constantly dropping new 2024/2025 content covering the latest vulnerabilities, stealer logs, and threat hunting techniques to help you strengthen your posture.

Stay sharp out there!

Zero-days don't take days off, and neither should your patching schedule. 🚨

Google just dropped its June 2026 Android update, and it’s a heavy hitter. They’re addressing CVE-2025-48595—a Framework zero-day that’s already seeing targeted exploitation in the wild.

The rundown:
🔹 Local privilege escalation
🔹 Impacts Android 14, 15, 16, and 16-QPR2
🔹 Officially added to the CISA KEV list
🔹 124 total vulnerabilities addressed in this rollout

If you're managing an Android fleet, bumping this to the top of your to-do list helps mitigate serious risk and strengthens your mobile posture. Time to get patching! 📱🔧

Zero-days don't take days off, and neither should your patching schedule. 🚨

Google just dropped its June 2026 Android update, and it’s a heavy hitter. They’re addressing CVE-2025-48595—a Framework zero-day that’s already seeing targeted exploitation in the wild.

The rundown:
🔹 Local privilege escalation
🔹 Impacts Android 14, 15, 16, and 16-QPR2
🔹 Officially added to the CISA KEV list
🔹 124 total vulnerabilities addressed in this rollout

If you're managing an Android fleet, bumping this to the top of your to-do list helps mitigate serious risk and strengthens your mobile posture. Time to get patching! 📱🔧

Let’s be real: keeping your skills sharp shouldn't cost an arm and a leg. Enter https://university.socradar.io/ —our learning hub built to help SOC analysts, cyber pros, and students level up their defensive game without draining their wallets.

Whether you're trying to break into the industry or you're a seasoned defender looking to rack up some CPE credits, we’ve got you covered.

What’s the deal?

This isn't just dry theory. We’re serving up actionable insights, dark web deep dives, and practical Cyber Threat Intelligence (CTI) workflows. We focus heavily on the global threat landscape and what threat actors are doing right now.

Why you should care:

💸 100% Free: No hidden paywalls. Keep your credit card in your wallet.

📜 Earn CPE Credits:Rack up 1 to 3 CPEs per course (perfect for ISACA, ISC2, etc.) to keep your CISSP, CISM, Sec+, or other certs active.

🌍 Real-World Tactics: We skip the fluff and focus on the current reality—from initial access brokers to Stealer-as-a-Service.

A few heavy-hitters to get you started:

🕵️ Fundamentals of the Dark Web (1 CPE): Unmask the underground economy, track Telegram stealer channels, and learn how the bad guys actually operate.

🤖 AI Fluency & GenAI Tools for Cyber Pros (3 CPEs): Move past basic prompts. Learn structured human-AI collaboration for threat reports, detection engineering, malware triage, and OSINT.

We’re constantly dropping new content covering the latest vulnerabilities, stealer logs, and threat hunting techniques to help you strengthen your posture.

Check it out and enroll for free here:https://university.socradar.io/

Stay sharp out there!