Week in Review: Active FortiBleed Attacks, Exploited Flaws and Major Breaches
Summary
The roundup covers active exploitation of multiple product flaws, the ongoing FortiBleed campaign, data breaches, phishing, malware, law-enforcement actions, and security developments involving AI and software.
Key points
- Attackers are exploiting flaws affecting Citrix NetScaler, Atlassian Data Center, Dell System Update, SonicWall SMA 1000, and Microsoft Exchange.
- A joint FBI and Secret Service advisory says FortiBleed attackers are locking some organizations out of Fortinet firewalls; more than 86,644 compromised devices were verified across 194 countries.
- Breaches affected Denmark’s Central Population Register, exposing information on 8.8 million people, and retailer ASOS.
- Phishing campaigns targeted YouTube creators with fake sponsorship offers and shoppers with fraudulent social-media discounts.
- Researchers reported malware and intrusions involving MATCHBOIL, BPFDoor, Flax Typhoon-linked tools, and the PoeLLM cryptomining botnet.
- Authorities seized sites selling stolen intimate images, while the FBI disrupted infrastructure linked to Flax Typhoon.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering vulnerability exploitation, malware and hacking operations, phishing, data breaches, law-enforcement actions, and security product updates.
- Impact
- Reported impacts include compromised Fortinet firewalls, exposure of personal information affecting 8.8 million people in Denmark, an ASOS data breach, phishing-related theft of payment-card details and one-time passwords, and disruptions associated with malicious activity. The roundup also describes vulnerabilities that could enable unauthorized access, remote code execution, or service disruption.
CVE
CVE-2026-102255SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255)CVE-2026-21589Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)CVE-2026-47483graphics processing unit (GPU) servers were open to a high-severity flaw in NVIDIA’s DCGM Exporter (CVE-2026-47483) that lets unauthenticated attackers crash the monitoring service and may disrupt AI workloads,CVE-2026-86360Dell System Update flaw allows attackers to gain root privileges (CVE-2026-86360)CVE-2026-88779CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)CVE-2026-96940Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940)
People
Threat Actors
Flax TyphoonChinese state-sponsored hacking group linked to the Microscan and FishHub tools, which the FBI says were used to target critical infrastructure and other organizations.ShinyHuntersA suspected member known as Rey was detained in Jordan and is reportedly helping the FBI track other group members.UAC-0099Russia-aligned group that uses MATCHBOIL to plant another program on Windows machines in Ukraine.
Malware
BPFDoorCitrix, SonicWall, Atlassian, Dell, Fortinet, and NVIDIA, alongside major incidents involving Matchboil, BPFDoor, FortiBleed, and Flax Typhoon.MatchBoilCitrix, SonicWall, Atlassian, Dell, Fortinet, and NVIDIA, alongside major incidents involving Matchboil, BPFDoor, FortiBleed, and Flax Typhoon.Milk Dragonsteal their payment card details and one-time passwords, Group-IB has warned. The phishing kit called Milk Dragon (also known as NaiLong) has been active since October 2025, and is linked to 258 phishing pages andNaiLongdetails and one-time passwords, Group-IB has warned. The phishing kit called Milk Dragon (also known as NaiLong) has been active since October 2025, and is linked to 258 phishing pages and victims in 66 countries.PoeLLM(C2) server in a poem posted on GitHub, according to Black Lotus Labs. The malware reading it, dubbed PoeLLM, breaks into exposed AI services and open-source tools, mines cryptocurrency on them and uses them to
Vendors
Anthropicat Denmark’s Central Population Register and ASOS, and new AI-related security concerns from Google, Anthropic, OpenAI, and Apple.ApplePopulation Register and ASOS, and new AI-related security concerns from Google, Anthropic, OpenAI, and Apple.ASOScampaigns targeting YouTubers and shoppers, data breaches at Denmark’s Central Population Register and ASOS, and new AI-related security concerns from Google, Anthropic, OpenAI, and Apple.Atlassianhighlighted active exploitation of critical flaws in products from Microsoft, Citrix, SonicWall, Atlassian, Dell, Fortinet, and NVIDIA, alongside major incidents involving Matchboil, BPFDoor, FortiBleed, andCitrixcybersecurity coverage highlighted active exploitation of critical flaws in products from Microsoft, Citrix, SonicWall, Atlassian, Dell, Fortinet, and NVIDIA, alongside major incidents involving Matchboil,Dellactive exploitation of critical flaws in products from Microsoft, Citrix, SonicWall, Atlassian, Dell, Fortinet, and NVIDIA, alongside major incidents involving Matchboil, BPFDoor, FortiBleed, and FlaxFortinetactive exploitation of critical flaws in products from Microsoft, Citrix, SonicWall, Atlassian, Dell, Fortinet, and NVIDIA, alongside major incidents involving Matchboil, BPFDoor, FortiBleed, and Flax Typhoon.Googlebreaches at Denmark’s Central Population Register and ASOS, and new AI-related security concerns from Google, Anthropic, OpenAI, and Apple.MicrosoftLast week’s cybersecurity coverage highlighted active exploitation of critical flaws in products from Microsoft, Citrix, SonicWall, Atlassian, Dell, Fortinet, and NVIDIA, alongside major incidents involving Matchboil,Nvidiaof critical flaws in products from Microsoft, Citrix, SonicWall, Atlassian, Dell, Fortinet, and NVIDIA, alongside major incidents involving Matchboil, BPFDoor, FortiBleed, and Flax Typhoon.OpenAICentral Population Register and ASOS, and new AI-related security concerns from Google, Anthropic, OpenAI, and Apple.SonicWallcoverage highlighted active exploitation of critical flaws in products from Microsoft, Citrix, SonicWall, Atlassian, Dell, Fortinet, and NVIDIA, alongside major incidents involving Matchboil, BPFDoor,
Products
Atlassian Data CenterAttackers are exploiting newly patched flaws in Citrix NetScaler, Atlassian Data Center, Dell System Update, SonicWall SMA 1000, and Microsoft Exchange Server.Citrix NetScalerAttackers are exploiting newly patched flaws in Citrix NetScaler, Atlassian Data Center, Dell System Update, SonicWall SMA 1000, and Microsoft Exchange Server.Dell System UpdateAttackers are exploiting newly patched flaws in Citrix NetScaler, Atlassian Data Center, Dell System Update, SonicWall SMA 1000, and Microsoft Exchange Server.Fortinet FortiGateaccording to a joint FBI and U.S. Secret Service advisory. FortiBleed targets internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The advisory cites SOCRadar, which has verified more than 86,644Microsoft Exchange ServerAttackers are exploiting newly patched flaws in Citrix NetScaler, Atlassian Data Center, Dell System Update, SonicWall SMA 1000, and Microsoft Exchange Server.NVIDIA DCGM ExporterSonicWall SMA 1000Attackers are exploiting newly patched flaws in Citrix NetScaler, Atlassian Data Center, Dell System Update, SonicWall SMA 1000, and Microsoft Exchange Server.
Tools
FishHubThe FBI seized seven domains used to operate Microscan and FishHub, two hacking tools linked to Chinese state-sponsored hackers known as Flax Typhoon that were used to target critical infrastructure and otherMicroScanThe FBI seized seven domains used to operate Microscan and FishHub, two hacking tools linked to Chinese state-sponsored hackers known as Flax Typhoon that were used to target critical infrastructure and other
Countries
DenmarkThe roundup also covered phishing campaigns targeting YouTubers and shoppers, data breaches at Denmark’s Central Population Register and ASOS, and new AI-related security concerns from Google, Anthropic, OpenAI, andFranceThe FBI and French law enforcement have seized two websites that sold hacked and stolen sexually explicit images and videos of young women and girls, and arrested their suspected administrator in northern France.JordanA suspected ShinyHunters member known as Rey has been detained in Jordan and is reportedly helping the FBI track down the rest of the group. Reuters reports that Jordanian authorities detained Saif al-Din Khader, aliasUkrainedownloader that the Russia-aligned group UAC-0099 uses to plant a second program on Windows machines in Ukraine. The program MATCHBOIL installs is a spying tool, and the access it creates may be useful to other groups.United States