Cyber Threat Brief — Issue #013

The story of FortiBleed changed fundamentally this week. SOCRadar's Threat Research Unit gained access to the internal infrastructure of the FortiBleed operation through an operational security failure by the attackers — a Windows server that exposed internal files, logs, and operational documentation. What they found inside changes the threat model for every organization with an internet-facing Fortinet VPN appliance. An operator tied to FortiBleed infrastructure was found actively logged into negotiation panels for both INC Ransom and Lynx ransomware operations simultaneously. Victim data from FortiBleed overlaps directly with victims already tracked on INC Ransom's public leak site. The operation behind FortiBleed is not a lone actor or a small team. Internal documentation reveals an organized group of approximately 20 people with defined roles across scanning, credential sniffing, cracking, access brokering, and ransomware deployment. The credential harvesting was never the end goal. It was the first step in a ransomware pipeline. At least 12 confirmed ransomware deployments have already resulted from credentials harvested in this campaign, with hundreds of endpoints encrypted across the affected organizations. INC Ransom and Lynx are widely assessed by researchers as operated by the same underlying group under different brand names, making this effectively one continuous criminal enterprise running a credential-to-ransomware supply chain at scale.

Citrix patched CVE-2026-8451 on June 30, 2026. Within 24 hours, Lupovis confirmed active exploitation from a Frankfurt-based IP address targeting their sensor network. The flaw is a memory overread vulnerability in how NetScaler parses SAML authentication requests, allowing unauthenticated attackers to read portions of process memory from internet-facing appliances. The leaked data can include credentials, session tokens, and certificate keys. CVE-2026-8451 is the third member of the CitrixBleed family, following CVE-2023-4966, which fed LockBit 3.0 ransomware attacks against Boeing and ICBC, and CVE-2025-5777, which received a one-day CISA patch deadline after exploitation was confirmed before public disclosure. The pattern is consistent across all three: unauthenticated memory disclosure, rapid exploitation after disclosure, CISA KEV listing within days, and eventual ransomware adoption. CVE-2026-8451 is not yet on the CISA KEV catalog. Based on the history of its predecessors, that is a matter of when, not if. The NCSC has issued an urgent patching advisory. Organizations running NetScaler as a SAML identity provider should treat this as a same-day patch regardless of KEV status.

Cisco Talos researchers disclosed ARToken this week, a new phishing-as-a-service platform specifically engineered to steal Microsoft 365 session tokens and establish persistent access that survives password resets and MFA changes. ARToken works by abusing the device code authentication flow in Microsoft 365, a legitimate feature designed for devices without browsers such as smart TVs and printers. Attackers send victims a phishing page that initiates a device code authentication request. When the victim enters their credentials and approves the login, ARToken captures the resulting session token rather than the password. Session tokens grant full account access and remain valid even after a password change. The platform is marketed as a business email compromise tool, with features for persistent inbox monitoring, email rule creation to hide attacker activity, and automated forwarding of sensitive communications. Device code phishing has been observed in nation-state campaigns by Russian and Iranian threat actors for years. ARToken commoditizes the technique and makes it available to any financially motivated attacker willing to pay the subscription fee.