[Security News] CISA Warns on Fortinet Credential Exposure (6.18)

CISA put Fortinet device hardening at the center of the June 18 security cycle after reports tied roughly 74,000 firewalls and VPN gateways to exposed…

Table of contents

1. Overview
2. CISA Puts Fortinet Hardening First After Credential Exposure Reports
3. Splunk Enterprise Flaw Enters CISA's Exploited-Vulnerability List
4. CISA Industrial Advisories Cover Factory, Medical and Energy Systems
5. Malware Reports Track Teams Relay Abuse and a USB-Spreading Clipper
6. INC Ransomware's Victim Count Shows Affiliate Pressure After LockBit and BlackCat
7. Morning Breaking Updates
8. At a glance
9. FAQ
10. Sources

CISA Warns on Fortinet Credential Exposure (6.18)

Overview

• CISA said internet-accessible Fortinet firewalls and VPN gateways were targeted with compromised credentials tied to roughly 74,000 exposed devices.
• CISA added Splunk Enterprise CVE-2026-20253 to the Known Exploited Vulnerabilities catalog after evidence of active exploitation.
• CISA issued industrial and medical advisories covering AzeoTech DAQFactory, Apollo Pharmacy APG-01 BT, Mitsubishi Electric, Schneider Electric and Rockwell Automation products.
• feeds.feedburner.com carried malware reporting on DragonForce-linked Backdoor.Turn traffic through Microsoft Teams relays and a Microsoft-described Windows clipper campaign.
• feeds.feedburner.com also reported that INC ransomware has claimed at least 830 victims since August 2023.

CISA Puts Fortinet Hardening First After Credential Exposure Reports

CISA said on June 18 that internet-accessible Fortinet devices across government and private-sector organizations had been targeted with compromised credentials. The agency described the activity as FortiBleed and tied it to leaked credentials associated with approximately 74,000 Fortinet devices, including firewalls and virtual private network gateways.

The immediate issue is credential exposure rather than a newly listed CVE in the provided CISA alert. That distinction matters for defenders. A patched appliance can still remain exposed if an old account, reused password or unmanaged remote-access path survives the maintenance window.

CISA urged affected Fortinet customers to harden their devices. In practical terms, the alert points security teams toward credential rotation, audit of externally reachable appliances, review of VPN access and removal of stale accounts. The agency also made clear that references to vendors or services in the notice do not amount to endorsement.

▸ Fortinet exposure deep dive

The Fortinet warning fits a recurring pattern in edge-device security: perimeter appliances keep remote access running, so credentials attached to them have long operational lives. Firewalls and VPN gateways often sit between enterprise identity systems and the public internet. When credentials leak, the exposed path may be useful even if no new exploit chain is disclosed.

The number in the CISA alert, approximately 74,000 Fortinet devices, gives administrators a scale marker rather than a confirmed compromise count. It says the exposure is broad enough to justify inventory-level action. The safer reading is that organizations should treat internet-facing Fortinet access as a priority review item, not as a niche device issue.

The response should start with assets reachable from the internet. Teams should confirm which Fortinet products expose management, VPN or administrative services, then compare those systems with identity logs. Credential rotation has more value when paired with session revocation and a review of privileged accounts. Otherwise, a changed password can coexist with an already established session or token.

The alert also draws a line between official confirmation and wider reporting. CISA confirmed awareness of global reports and stated that actors targeted devices using compromised credentials. It did not provide exploit code, a payload, a CVSS score or a new CVE identifier in the supplied text. That leaves defenders with a mitigation-led response: harden configuration, reduce public exposure, enforce multifactor authentication where available and examine access logs for unusual successful logins.

For ordinary users, the takeaway is indirect. This is mainly an enterprise and government network issue. For administrators, it is a reminder that remote-access appliances need the same credential hygiene as cloud identity platforms. For executives, the operational risk is service access, not just device firmware. A firewall or VPN gateway can become an entry point when old credentials remain valid.

Splunk Enterprise Flaw Enters CISA's Exploited-Vulnerability List

CISA added CVE-2026-20253 to its Known Exploited Vulnerabilities catalog on June 18. The agency identified it as a Splunk Enterprise missing authentication for critical function vulnerability and said the catalog entry was based on evidence of active exploitation.

The KEV designation changes the urgency. CISA's Known Exploited Vulnerabilities catalog is reserved for flaws with real-world exploitation evidence, not merely theoretical risk. Federal civilian agencies follow binding remediation timelines for KEV entries, and private organizations often use the catalog to set patch priority.

The provided CISA text did not include a CVSS 3.1 score, affected Splunk Enterprise versions or a vendor workaround. Even without those details in the excerpt, the vulnerability class is serious. Missing authentication for a critical function can expose privileged behavior to an attacker who should not be able to invoke it.

▸ Splunk KEV deep dive

Splunk Enterprise often holds logs, security telemetry, operational data and investigation records. That role raises the impact of authentication flaws. A weakness in a monitoring platform can affect both the protected environment and the evidence defenders rely on after an incident.

CISA's KEV catalog entry supplies one important fact: exploitation has been observed. That moves the issue ahead of many high-severity vulnerabilities that remain unexploited in public reporting. For security teams, KEV status is a patch-ordering tool. It does not replace vendor guidance, but it helps decide what must be addressed before routine maintenance.

The vulnerability name also matters. Missing authentication for a critical function means a control path may be reachable without the expected identity check. The exact affected versions and the CVSS score are not present in the supplied source data, so they should not be guessed. The responsible next step is to align Splunk deployments with the vendor's security update guidance and verify whether exposed management interfaces or administrative endpoints are reachable from untrusted networks.

This entry also affects incident response planning. If an organization uses Splunk to collect logs from identity providers, firewalls, cloud accounts or endpoint tools, a compromise of Splunk could impair detection. Teams should preserve logs outside the platform when investigating suspicious access around the remediation window. That reduces reliance on a potentially affected system.

The broader lesson is about catalog-driven patching. Vulnerability backlogs often contain thousands of CVEs, and severity alone can mislead prioritization. CISA's KEV flag adds an exploitation signal. When a flaw has both privileged product context and active exploitation evidence, it deserves faster handling than an equally scored issue buried in an internal-only component.

CISA Industrial Advisories Cover Factory, Medical and Energy Systems

CISA published several advisories on June 18 affecting operational technology and medical-adjacent products. The list included AzeoTech DAQFactory, Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT, Mitsubishi Electric MELSEC iQ-F products, Schneider Electric product families and Rockwell Automation FactoryTalk Historian Site Edition.

The AzeoTech advisory named CVE-2026-12390 and said DAQFactory versions up to and including 21.1 are affected. CISA said successful exploitation could allow an attacker to upload malicious .ctl files that may lead to arbitrary code execution.

For Rockwell Automation FactoryTalk Historian Site Edition, CISA's excerpt identified FactoryTalk Historian SE 11 and CVE-2025-13036. The agency said exploitation could allow an attacker to obtain a valid authentication token, cause a denial of service or crash the system.

The medical advisory for Apollo Pharmacy's Blood Glucose Monitoring System APG-01 BT described risks to sensitive health-related information and legitimate device connections. The Mitsubishi Electric advisories focused on denial-of-service conditions against MELSEC iQ-F networking products. Schneider Electric's advisory covered PowerChute Serial Shutdown within a broader set of named product families.

▸ industrial advisories deep dive

Operational technology advisories require a different reading from ordinary enterprise software bulletins. A vulnerable factory or medical device may not be easy to patch immediately. Maintenance windows can depend on production schedules, validation requirements and physical access. That makes compensating controls more important while vendors and operators prepare updates.

The DAQFactory issue is the most direct code-execution item in the supplied advisories. CISA's wording connects malicious .ctl file upload to arbitrary code execution. That suggests defenders should focus not only on version checks, but also on who can submit or modify control files. Network segmentation, file integrity monitoring and role review can reduce exposure while patch plans move through operations.

The Rockwell Automation advisory points to a different risk profile. A valid authentication token can support unauthorized access, while denial of service and system crashes affect availability. In historian systems, availability matters because they collect and preserve industrial process data. Losing historian visibility can interfere with troubleshooting, compliance reporting and post-incident analysis.

The Apollo Pharmacy device advisory moves the concern toward privacy and patient-facing availability. CISA said successful exploitation could expose sensitive health-related information and prevent legitimate users from establishing a connection. Even when an affected device is not part of a hospital network, security teams should treat medical-device connectivity as a data-protection issue.

The Mitsubishi Electric excerpts describe denial-of-service paths against Ethernet-facing industrial modules. One advisory cited heavy communication packets to the Ethernet port, while another cited rapid establishment of large numbers of TCP connections. The shared defensive theme is traffic control. Rate limiting, network isolation and blocking unnecessary access to controller networks can reduce exploitability without waiting for every device to be replaced.

The provided text did not include CVSS scores for these advisories. It also did not include all CVE identifiers for every product line. That missing detail does not reduce the need for inventory work. The first practical question is whether affected products exist in the environment. The second is whether they are reachable from enterprise, vendor, wireless or remote-access networks.

Malware Reports Track Teams Relay Abuse and a USB-Spreading Clipper

feeds.feedburner.com reported that DragonForce-associated actors used a custom Go-based remote access trojan called Backdoor.Turn to hide command-and-control traffic inside Microsoft Teams relay infrastructure. The report cited findings from Broadcom-owned Symantec and Carbon Black and said the backdoor was deployed against a major U.S. services firm.

That tactic matters because relay infrastructure can blend malicious traffic with legitimate collaboration traffic. The supplied reporting does not name the victim company. It also does not provide a CVE or a patchable product flaw. This is threat-activity reporting, so defenders should treat it as a detection and monitoring problem.

A separate feeds.feedburner.com item said Microsoft disclosed a Windows-based cryptocurrency clipper campaign active since February 2026. The malware targeted users with clipboard interception, self-spreading behavior and Tor-based command-and-control communication. The report said the campaign relied on Windows Script Host and ActiveX-driven logic to launch a bundled Tor proxy.

▸ malware campaigns deep dive

Both malware reports point to abuse of legitimate or common infrastructure rather than a single emergency patch. Backdoor.Turn used Microsoft Teams relay infrastructure as cover for command-and-control traffic, according to the Symantec and Carbon Black findings cited by feeds.feedburner.com. The clipper campaign used Windows features and Tor communication to make ordinary endpoint activity harder to judge at a glance.

The Teams relay case is difficult because many organizations cannot simply block Teams-related traffic. Collaboration tools are business-critical, and broad blocking can break normal operations. That pushes defenders toward behavioral detection: unusual process ancestry, unexpected Go binaries, abnormal relay patterns, rare destination combinations and lateral movement around collaboration endpoints.

The Windows clipper campaign has a different victim model. Cryptocurrency clippers monitor clipboard content and swap wallet addresses or payment details. The self-spreading USB LNK element raises the risk in environments where removable media remains common. Windows Script Host and ActiveX are not automatically malicious, but many organizations can restrict them for users who do not need scripting.

The Tor element provides another useful detection angle. A bundled Tor proxy can create network behavior that differs from normal browser use. Security teams should watch for unsigned or unexpected processes initiating Tor-like communication, especially when paired with script interpreters, shortcut files or removable-drive activity.

Neither report should be converted into panic about Microsoft Teams or Windows as products. The stronger reading is operational: attackers continue to hide inside tools and protocols that defenders cannot easily remove. That makes endpoint telemetry, egress monitoring and script-control policy more valuable than relying on network blocklists alone.

For users, the clipper risk has a simple consequence. A copied wallet address should be checked before payment. For enterprises, the larger control is to limit script execution, scan removable drives and investigate unauthorized Tor components. For collaboration-relay abuse, teams need detection logic that distinguishes sanctioned application traffic from malware using the same route.

INC Ransomware's Victim Count Shows Affiliate Pressure After LockBit and BlackCat

feeds.feedburner.com reported that researchers charted INC ransomware's growth from an early ransomware-as-a-service operation into one of the more prolific cybercrime groups in 2026. The report said INC has claimed no fewer than 830 victims since August 2023.

The article cited Acronis as saying the disruption of LockBit and the shutdown of BlackCat created opportunities for INC to expand as affiliates moved to alternative ransomware operations. That framing places INC's growth inside the ransomware market, where affiliates often shift when major brands lose infrastructure or credibility.

The supplied reporting does not identify a new exploit chain, CVE or single targeted product. It is a threat-landscape development. The operational response is therefore broader: reduce exposed remote access, strengthen backups, rehearse recovery and watch for intrusion patterns linked to ransomware affiliates.

▸ INC ransomware deep dive

Ransomware-as-a-service depends on two groups: operators who maintain the brand, infrastructure and leak site, and affiliates who conduct intrusions. When larger operations such as LockBit or BlackCat suffer disruption, affiliates still need a place to monetize access. Acronis' assessment, as reported by feeds.feedburner.com, describes that migration pressure as a factor in INC's expansion.

The 830-plus victim figure since August 2023 should be read carefully. Ransomware victim counts often come from claimed leak-site postings and research tracking. They are useful for trend direction, but they are not the same as independently verified breach counts for every named organization. Even with that caveat, the number signals sustained activity over nearly three years.

For defenders, the lesson is that takedowns do not eliminate affiliate capability. They can displace it. A mature affiliate may reuse access brokers, phishing processes, remote-access tooling and data-theft habits while changing the ransomware brand used at the final stage. That means defensive programs should focus on intrusion paths, not only on the name displayed in a ransom note.

The most practical controls remain familiar because ransomware economics have not changed. Offline or immutable backups reduce pressure during extortion. Segmented administrative access limits blast radius. Endpoint detection can catch tooling before encryption. Egress monitoring can reveal data theft before a leak-site post appears.

The INC report also shows why security teams need current threat intelligence but should avoid overfitting to a single group. Today's affiliate may work under one banner and move to another when enforcement, internal disputes or payment problems change the market. Controls tied to behaviors survive those shifts better than controls tied to brand names.

Morning Breaking Updates

• microsoft.com: New Forrester study shows customers who unified with Microsoft Security benefited from 124% ROI - Across many industries, organizations are unifying security and putting AI agents to work. Security teams are utilizing agents that reason, decide, and act on their behalf, under t
• feeds.feedburner.com: F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution - F5 has released security updates to address two critical security flaws in NGINX Open Source that could be exploited to achieve code execution on affected systems. The vulnerabilit
• feeds.feedburner.com: Orphaned AI Agents: How to Find Hidden Access Risks Inside Your Network - If an autonomous AI agent interacts with your company's core intellectual property today, can your security team instantly name the person who authorized it? For most enterprises,
• feeds.feedburner.com: ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories - The internet did not break this week. It got used exactly as designed, which is worse. Searches were siphoned through shady browser add-ons. AI chat links turned into malware deliv

▸ More — additional context and sources

CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure

Reported by cisa.gov.

CISA is aware of global reports that malicious cyber actors have targeted internet-accessible Fortinet devices across government and pri…

The Scripts on Your Checkout Page Are Now a PCI DSS Problem

Reported by feeds.feedburner.com. An independent PCI assessor tested Reflectiz against the new PCI DSS rules.

DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic

Reported by feeds.feedburner.com. Threat actors associated with the DragonForce ransomware have been observed using a custom Go-based remote access trojan (RAT) called Backd…

Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2

Reported by feeds.feedburner.com. Microsoft has disclosed details of a Windows-based cryptocurrency clipper campaign that has targeted users since February 2026 with clipboa…

INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023

Reported by feeds.feedburner.com. Cybersecurity researchers have charted the evolution of INC from an nascent ransomware-as-a-service (RaaS) operation to one of the most pro…

At a glance

Fact	Publisher	Source
CISA linked FortiBleed reports to about 74,000 Fortinet devices with exposed credentials.	cisa.gov	cisa.gov
CISA added CVE-2026-20253, a Splunk Enterprise flaw, to its KEV catalog.	cisa.gov	cisa.gov
AzeoTech DAQFactory <=21.1 is affected by CVE-2026-12390.	cisa.gov	cisa.gov
Rockwell FactoryTalk Historian SE 11 is affected by CVE-2025-13036.	cisa.gov	cisa.gov
Microsoft described a Windows clipper campaign active since February 2026.	feeds.feedburner.com	thehackernews.com
Symantec and Carbon Black reported Backdoor.Turn use against a major U.S. services firm.	feeds.feedburner.com	thehackernews.com
Acronis linked INC ransomware growth to at least 830 claimed victims since August 2023.	feeds.feedburner.com	thehackernews.com

FAQ

Q1. What is the main confirmed Fortinet issue in this cycle?

A. CISA confirmed reports of compromised credentials used against internet-accessible Fortinet devices. The supplied alert ties the activity to approximately 74,000 firewalls and VPN gateways, but it does not name a new CVE or CVSS score.

Q2. Why does the Splunk KEV listing change patch priority?

A. CISA added CVE-2026-20253 to the KEV catalog because of active exploitation evidence. KEV status gives defenders a stronger prioritization signal than severity alone, especially for Splunk Enterprise systems that hold security and operational logs.

Q3. What should industrial operators do first with the CISA advisories?

A. Operators should inventory affected products before scheduling fixes. CISA named DAQFactory <=21.1, FactoryTalk Historian SE 11, Apollo APG-01 BT and Mitsubishi Electric MELSEC iQ-F products among the June 18 advisory set.

Q4. How do the malware reports differ from the CVE advisories?

A. feeds.feedburner.com described observed campaigns, not patchable CVEs. Backdoor.Turn abused Microsoft Teams relay infrastructure, while Microsoft's clipper report involved Windows Script Host, ActiveX logic, USB spread and Tor-based command-and-control communication.

Q5. What should teams watch after the INC ransomware report?

A. feeds.feedburner.com cited Acronis on INC's expansion to at least 830 claimed victims since August 2023. Teams should watch affiliate-driven intrusion paths, backup integrity, remote-access exposure and data-theft signals rather than only the ransomware brand name.

Sources

1. Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2 - feeds.feedburner.com
2. INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023 - feeds.feedburner.com
3. The Scripts on Your Checkout Page Are Now a PCI DSS Problem - feeds.feedburner.com
4. DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic - feeds.feedburner.com
5. CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure - cisa.gov
6. AzeoTech DAQFactory - cisa.gov
7. Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT - cisa.gov
8. Mitsubishi Electric Co.'s MELSEC iQ-F Series FX5-ENET/IP Ethernet Module - cisa.gov
9. Mitsubishi Electric MELSEC iQ-F Series - cisa.gov
10. Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products - cisa.gov
11. CISA Adds One Known Exploited Vulnerability to Catalog - cisa.gov
12. Rockwell Automation FactoryTalk Historian Site Edition - cisa.gov
13. National Vulnerability Database - NIST
14. Microsoft Security Response Center - Microsoft
15. Google Online Security Blog - Google
16. New Forrester study shows customers who unified with Microsoft Security benefited from 124% ROI - microsoft.com
17. F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution - feeds.feedburner.com
18. Orphaned AI Agents: How to Find Hidden Access Risks Inside Your Network - feeds.feedburner.com
19. ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories - feeds.feedburner.com

Last updated: 2026-06-19T10:53:28.750Z