Loading story…
Security reporting highlighted active exploitation against Fortinet FortiGate devices, with claims that hundreds of firewalls were compromised in what was described as “AI-powered” attack activity attributed to AWS-sourced observations. The available excerpt for this item is truncated to newsletter boilerplate, so technical details (e.g., exploited CVEs, affected firmware branches, or IOCs) are not present in the provided content.
Separate reporting described a recent Roundcube webmail vulnerability being exploited in the wild, indicating ongoing attacker interest in email/webmail infrastructure. A third item is a malware-newsletter roundup aggregating many unrelated stories (including Android malware, infostealers, and a Dell RecoverPoint zero-day mention) and does not provide a single coherent incident narrative tied to the FortiGate or Roundcube exploitation described above.
See which actors are running it and whether you're in range.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcesecurityweek.com
Open sourcesecurityweek.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The provided items do not describe a single cohesive incident; they are a mix of unrelated security research, tooling write-ups, newsletters, and commentary. The most concrete incident reporting is an **AI-assisted intrusion campaign** in which a Russian-speaking financially motivated actor compromised **600+ Fortinet FortiGate** devices by targeting internet-exposed management interfaces with **weak credentials and no MFA**, then using AI-generated scripts for recon, configuration theft, and follow-on activity (including attempts to move laterally into **Active Directory**, extract database credentials, and access backup infrastructure). Separately, Kaspersky-linked reporting described **Arkanix Stealer** as a short-lived infostealer operation marketed in late 2025 with a modular design and anti-analysis features, with indicators of **LLM-assisted development** and a brief operational lifespan after promotion on dark-web forums and use of Discord for “customer” support. Other references are not about that Fortinet campaign and instead cover distinct topics: academic research demonstrating **27 attacks** against major password managers under a **malicious server** model (undermining “zero-knowledge” assumptions via missing ciphertext integrity/binding), GreyNoise telemetry on **OAST/interactsh** callback-domain scanning trends, and a vendor-style overview of an AI-driven pentesting framework (*PentAGI*) integrating 20+ tools. Several entries are primarily **roundup/newsletter** content or **generic guidance/commentary** (e.g., phishing what-to-do advice, compliance vs. security, historical/legal computing anecdote), and one is a threat-actor profile tying **Lotus Blossom** to a separate *Notepad++* update-channel incident rather than the Fortinet activity.
Jun 29, 2026
Multiple maximum-severity vulnerabilities in enterprise infrastructure management products are being **actively exploited**, enabling unauthenticated remote code execution as `root` and creating high-impact initial access paths into data center and security operations environments. Reported exploitation includes mass, automated scanning and rapid weaponization following public disclosure and PoC availability, increasing the likelihood of opportunistic compromise, follow-on payload delivery, and lateral movement in affected networks. Fortinet *FortiSIEM* is reported as under active attack via **CVE-2024-23108**, an unauthenticated command-injection issue in the `phMonitor` component (noted as listening on TCP `8014`) that can yield full system compromise. Separately, Cisco *Secure Email Gateway* / *Secure Email and Web Manager* is reported as exploited via **CVE-2024-20353** (CVSS 10.0), with activity attributed to China-linked **UAT-9686** leveraging the Spam Quarantine interface to gain root execution and deploy custom malware for persistence and evasion. In parallel, Check Point-linked reporting describes **RondoDox** botnet-driven exploitation of HPE *OneView* **CVE-2025-37164** at scale (tens of thousands of attempts observed), consistent with an “exploit-shotgun” approach used to build botnets for DDoS, cryptomining, and secondary payload delivery; the surge coincided with the flaw’s addition to CISA’s known-exploited list.
Jun 29, 2026
Multiple reports highlight active campaigns using *phishing* and *software supply-chain abuse* to steal credentials and establish persistence. eSentire described an espionage-focused operation targeting residents of India with emails impersonating the Income Tax Department, leading victims to a malicious archive that uses DLL side-loading with a legitimate signed Microsoft application, extensive anti-analysis checks, in-memory shellcode unpacking, UAC bypass, and process masquerading; the payload was identified as a **Blackmoon**-family variant that specifically attempts to disable **Avast Free Antivirus** by automating UI interactions to add exclusions. Separately, Aikido reported a malicious npm package (`ansi-universal-ui`) that deploys a multi-stage infostealer (“**G_Wagon**”) by abusing `postinstall` execution, downloading a Python runtime, running an obfuscated payload, and exfiltrating browser credentials, cloud credentials, Discord tokens, and data from 100+ cryptocurrency wallets to an Appwrite storage bucket; it also includes a Windows DLL used for browser-process injection via NT native APIs. In parallel, network-edge exploitation remains a key access vector: Risky Business reported a renewed wave of attacks against **Fortinet FortiGate** devices via a vulnerability Fortinet allegedly “patched” in December but which attackers can still exploit, enabling SSO authentication bypass (via crafted SAML), creation of new admin accounts, and theft of device configuration; mitigations include disabling the FortiCloud SSO feature (not enabled by default). Several other items are general awareness or roundup content rather than specific incident reporting: TechTarget and other blogs emphasized ongoing phishing/email risk (including relay spam abusing legitimate Zendesk instances) and password hygiene, while The Hacker News published a multi-story bulletin that includes (among other items) a spear-phishing campaign in Afghanistan delivering a FALSECUB backdoor via a GitHub-hosted ISO and LNK execution chain; Risky Business also covered Iran’s internet blackout and Starlink jamming/spoofing as a communications-control issue rather than an enterprise cyber incident.
Jun 29, 2026