Cybersecurity researchers have detailed a large-scale campaign targeting exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. The operation has resulted in the exposure of over 70,000 credentials and affected numerous organizations worldwide. Attackers are reported to have exploited exposed network edge devices to gain initial access, with attempts at further compromise and lateral movement observed. The full scope of exploitation vectors, specific CVEs, and threat actor attribution remain under investigation.

What should defenders do?

Ensure FortiGate and GlobalProtect devices are updated to the latest available firmware. Harden configurations by restricting external access to management interfaces. Implement network segmentation to limit lateral movement. Monitor for suspicious activity on edge devices. Apply principle-of-least-privilege access controls.

highCyber Attacks

Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

Large-scale campaign targets Fortinet FortiGate and Palo Alto Networks GlobalProtect edge devices globally

Cyber.TechVoidPublished about 1 hour agoUpdated less than a minute ago1 min read

Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

Key Takeaways

A large-scale campaign has targeted exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect firewall and VPN appliances.
Over 70,000 credentials have been exposed as a result of the campaign.
Numerous organizations worldwide have been affected, with attackers attempting further compromise and lateral movement.

Related Security News

highCyber Attacks

Russian-Linked Hackers Deploy New Mesh Network Backdoor in Destructive Ukraine Attack

According to ESET, the Russian state-sponsored hacking group Sandworm collaborated with threat actor UAC-0099 (aka Earth Sirrush) to conduct a destructive wiping attack against a Ukrainian logistics company. Initial access was obtained on July 16, 2025, via a spear-phishing email with a malware-laced attachment. The attack deployed a new mesh network backdoor, enabling covert communication and control. The incident was publicly reported in October 2026.

The Hacker News16 minutes ago1 min read