FortiBleed Exposes 86,000 FortiGate Devices as North Korea's Sapphire Sleet Poisons the Mastra npm Catalog

A Russian-speaking crew has weaponized leaked credentials from roughly half the internet-facing Fortinet fleet, while a parallel wave of supply-chain attacks — Mastra npm, the Klue OAuth breach, and a Vertex AI bug — turned developer and AI tooling into the day’s softest entry points.

Credential Theft & Initial Access

• FortiBleed has compromised credentials tied to 86,644 FortiGate firewalls and SSL-VPN gateways — about half of all internet-accessible Fortinet devices — in a campaign CISA, NCSC-UK, and CERT.dk all flagged this week (The Hacker News, CISA). Researcher Volodymyr Diachenko, who broke the story, traced an open directory showing SSL-VPN auth intercepted at scale, ~1.16 billion credential attempts against 320,000+ FortiGate targets (plus 2.1 billion against 160,000+ MSSQL servers), offline hash-cracking on a GPU cluster, and plaintext reuse for lateral movement into Active Directory — with at least four full compromises including a NATO defense contractor (Hunt.io via Florian Roth).
• A threat actor Dark_Alpha / ALPHA-GROUP is now selling the bulk access as a “FortiBleed” listing — ~35,000 corporate accesses in url:user:pass:domain:revenue format spanning 194 countries, priced around $25K (Dark Web Informer). Anyone running Fortinet SSL-VPN should treat all device and AD credentials as burned and rotate now.

Cloud & Identity

• Klue, a competitive-intelligence platform, confirmed attackers stole OAuth tokens used to connect to customers’ Salesforce environments, and the new Icarus extortion group has claimed it (BleepingComputer). Salesforce disabled the Klue Battlecards integration on June 11; this is the third Salesforce-connected app abused for CRM data theft, and confirmed victims include security vendors Huntress and Recorded Future (SecurityWeek, The Hacker News).

AI & Model Security

• North Korea’s Sapphire Sleet (BlueNoroff/APT38) hijacked a maintainer account to republish the entire @mastra/ npm catalog — as many as 145 packages — trojanized to drop an infostealer via a postinstall payload (easy-day-js) (Microsoft, The Hacker News). Nextron detailed the loader chain: an obfuscated stager re-spawns detached to survive npm install, locks a single instance under /tmp/_installer/, and pulls an OS-specific Rust infostealer (ELF + Mach-O) that hunts crypto seed phrases, browser-wallet LevelDB, .env/.npmrc/SSH keys, cloud creds, and enumerates SentinelOne, Defender, Little Snitch, and Tailscale on macOS (Nextron). Mastra is an AI-application framework, putting AI dev pipelines squarely in the blast radius.
• A related APT38 PowerShell sample from the Axios npm compromise shows the operators actively evolving — same persistence, User-Agent, and victim-UID logic, but with {ARG}-placeholder C2 delivery, raw-JSON POST bodies, and expanded recon (installed apps, extensions, AV, admin checks) (@unpacker).
• Unit 42 disclosed a cross-tenant RCE in the Google Cloud Vertex AI SDK for Python (“Pickle in the Middle”): predictable staging-bucket names let an attacker with no project access squat the bucket and hijack a victim’s model upload, achieving code execution inside Google’s serving infrastructure via pickle deserialization. Fixed in google-cloud-aiplatform v1.148.0 (Unit 42, The Hacker News).
• Microsoft detailed AutoJack, an exploit chain that turns an AI browsing agent into an RCE delivery vehicle: steer the agent to an attacker page, and its JavaScript reaches a privileged local service to spawn a host process — no credentials or further interaction required (The Hacker News). Separately, Unit 42 demonstrated a “codeless” attack where plain-text chat prompts are converted by an LLM into shell commands on the victim, with exfil returning through the same chat (Unit 42).
• A coordinated campaign published 15 malicious JetBrains Marketplace plugins posing as AI coding assistants to exfiltrate AI provider API keys, alongside Chrome extensions capturing chatbot sessions (The Hacker News).

Ransomware & EDR Evasion

• ESET published a deep dive on the Gentlemen RaaS’s EDR-killer portfolio, centered on the in-house GentleKiller framework (eight variants, each impersonating a different legitimate product) and supplemented with HexKiller, ThrottleBlood, and HavocKiller. Across builds it targets 400+ processes mapped to 48 security products; leaked Gentlemen data confirmed GentleKiller as an internal tool and linked one affiliate to a stealer ESET named OxideHarvest. IoCs are on GitHub (WeLiveSecurity, BleepingComputer).
• INC has grown into one of 2026’s most prolific RaaS operations with 830+ victims since August 2023, absorbing affiliates after the LockBit and BlackCat disruptions (The Hacker News). Current leaderboard tracking puts Qilin at 651 attacks, The Gentlemen at 430, and Akira at 282 (DarkFeed).
• DeadLock is expanding its abuse of Polygon blockchain smart contracts — moving beyond chat-proxy rotation to host its data-leak site entirely on-chain (75 victims since February), with HTML ransom notes fetching victim data live from the contract (ESET). Nextron flagged KRYBIT, a new double-extortion strain whose YARA profile overlaps heavily with the leaked Babuk codebase (Nextron), and Prinz Eugen emerged prioritizing recently-modified files for faster encryption while leaving no ransom note (BleepingComputer).
• Operation Endgame dismantled SocGholish infrastructure — 106 C2 servers and domains taken down and nearly 15,000 infected WordPress sites cleaned, led by Dutch, Canadian, German, and U.S. authorities (The Hacker News, SecurityWeek).

Vulnerabilities & Exploits

• CVE-2026-20253, a critical unauthenticated arbitrary-file-write in the Splunk Enterprise PostgreSQL sidecar, is under active exploitation days after disclosure — CISA gave federal agencies a three-day patch deadline. The same advisory cluster includes an RCE via unsafe deserialization (CVE-2026-20251) (BleepingComputer, Horizon3).
• F5 shipped out-of-band patches for two critical NGINX Open Source flaws, including CVE-2026-42530 (“nginx-quicburst,” CVSS 9.2) — a use-after-free in the HTTP/3 QUIC module (ngx_http_v3_module) allowing remote unauthenticated RCE. It’s only the third NGINX bug since 2014 to earn a “major” rating; affects 1.31 with QUIC enabled, and a technical write-up with ASLR bypass is promised July 18 (The Hacker News, Nebula Security).
• Cisco patched CVE-2026-20262, an actively-exploited arbitrary-file-write/privilege-escalation flaw in Catalyst SD-WAN Manager (formerly vManage), with a CISA remediation deadline of June 29 (The Register, SecurityWeek).
• CISA added two more actively-exploited bugs to KEV: CVE-2026-48907 (CVSS 10.0) in the Joomla Content Editor, enabling authenticated PHP code execution (The Hacker News), and CVE-2026-54420 in the LiteSpeed cPanel Plugin, exploited for root privilege escalation (The Hacker News). CVE-2026-35273 in Oracle PeopleSoft PeopleTools was also added, with ransomware association (DarkFeed).
• Gamaredon is exploiting the WinRAR path-traversal flaw CVE-2025-8088 against Ukrainian targets: military/conscription-themed .rar lures use a malicious NTFS alternate data stream to silently plant a .lnk into the Startup folder on extraction, executing a hidden PowerShell stager on next logon. Active since February 2026 and ongoing (Nextron).
• Microsoft confirmed RoguePlanet (CVE-2026-50656, CVSS 7.8), a privilege-escalation zero-day in the Defender Malware Protection Engine, with a patch in development (The Hacker News).
• Paradigm Shift published usbliter8, a working — and unpatchable — exploit achieving code execution inside the SecureROM boot chain of Apple A12/A13 silicon. It requires physical USB access but cannot be fixed in software (Paradigm Shift, The Hacker News).

Threat Intelligence

• ESET uncovered two undocumented Windows variants of the SprySOCKS backdoor (WIN_DRV and WIN_PLUS), attributed with high confidence to China-nexus FishMonger and used against governments in Honduras, Taiwan, Thailand, and Pakistan. WIN_DRV weaponizes a kernel driver to redirect traffic to a hidden TCP port triggered by crafted packet data, with possible UEFI bootkit involvement (WeLiveSecurity, The Hacker News).
• Rapid7 detailed Dropping Elephant delivering an in-memory RAT via a China-themed loader chain; Nextron tied 44 samples to one continuous LNK-loader line spanning May 2023 to June 2026, each a shortcut posing as a PDF that fires a hidden PowerShell stager with sandbox/debugger checks before self-deleting (Nextron).
• North Korea’s ScarCruft (APT37) is impersonating Microsoft account security alerts in spear-phishing to deploy a new RAT, NarwhalRAT, via a multi-stage chain abusing Korean websites and pCloud (The Hacker News). SideCopy (APT36) swapped its military-briefing lure for a fake “Minutes Of Meeting” double-extension .lnk dropping a .NET RAT persisted via the HKCU Run key (Nextron).
• ClickFix campaigns expanded with three new loaders — BabaDeda, Lorem Ipsum, and Potemkin — per Morphisec, BlueVoyant, and Huntress, with the Lorem Ipsum activity possibly tied to Vice Society (The Hacker News). Microsoft also detailed CryptoBandits, a USB-LNK worm spreading a Windows clipper that uses Windows Script Host, ActiveX, and a bundled Tor proxy for C2 (BleepingComputer).
• Krebs linked the Popa botnet — millions of compromised Android TV boxes relaying traffic for ad fraud, account takeovers, and scraping — to NetNut, a residential-proxy provider run by NASDAQ-listed Israeli firm Alarum Technologies (Krebs on Security). A new Rust-based MaaS, Vektor, is being advertised with a subscriber panel, crypto-drainer, clipper, and CIS-exclusion for ~$120–$450/month (Dark Web Informer).

Data Breaches

• Novo Nordisk is the subject of a breach claim by FulcrumSec, which says it stole 1.3 TB — including proprietary research and credentials — via a leaked GitHub token, demanding $25M and exposing the company’s software development pipeline (SecurityWeek, Dark Reading).
• The Texas Parks and Wildlife Department disclosed a vendor breach exposing data on 3+ million individuals, including driver’s license numbers (BleepingComputer). Nintendo of America confirmed survey data was stolen from a third-party (TinyPulse/WebMD subsidiary) service, with its own systems unaffected (BleepingComputer).

Detection & Purple Team

• Huntress walked through containing a real intrusion at a nursing-facility network: initial access via an exposed RDWeb portal and a compromised test account, followed by RDP lateral movement, enumeration, and persistence attempts — caught and shut down by Managed EDR, Defender telemetry, and SOC response that disabled accounts and blocked the attacker IP before full compromise (Huntress). A useful reminder that internet-exposed RDWeb plus weak test accounts remains a top initial-access path.

Industry & Policy

• Ukraine launched TrophyLab, a secure platform giving allied governments, labs, and defense-tech firms access to captured Russian drones, missiles, EW systems, and vehicles — including firmware, technical reports, and identified vulnerabilities — to accelerate reverse engineering and countermeasure development (Mykhailo Fedorov).
• A threat actor (“shabat”) is advertising access-as-a-service to France’s CHEOPS police information system, claiming on-demand lookups across TAJ, FPR, CR, ENQUETE, and vehicle-registration (SIV) records at $75–$300 per query — pointing to insider access or a compromised police device. Unverified, but real-time query access is far more valuable than static dumps (Daily Dark Web).
• Pro-Russian NoName057(16) and Dark Storm Team ran coordinated DDoS sprees against French and Belgian government, energy, and municipal targets — including Belgium’s Federal Agency for Nuclear Control and grid operator Elia (FalconFeeds).