[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fr9uUFGqEoJGMNN3QJcesTzFcu5q4anJ_k4Z-g4ORDEI":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"8bc54ec0-7f91-4f7e-8f9d-08bbebc40f6e","Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials","hackers-breach-enterprise-firewalls-and-vpns-exposing-over-70-000-credentials-64b0ac","Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. \"Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims,","A large-scale campaign has been uncovered by cybersecurity researchers, targeting exposed network edge devices including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. The attackers successfully breached these systems, leading to the exposure of over 70,000 credentials. Evidence suggests the campaign has impacted numerous organizations globally, with attempts to further compromise some victims.","Hackers exploited enterprise firewalls and VPNs, exposing over 70,000 credentials.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fhackers-breach-enterprise-firewalls-and.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiSk-Q06Dd5YyYmXWMt9b860DzGRKbTae_QwvoZDKNICaEznAj2AUurJmv6vPnpcH7qqDjauFZWWx7GX1RN93BLaU9Rqgiqe9j1iQRg2Vqcz3HpSqgesA6oS-GrMTyx4CTzwOD7C_z205k57ZpT70Gv4RXi-65X-nyI04wpA3raJ5nh46pN5ox42cyLnHjv\u002Fs1600\u002F1000117358.jpg","2026-10-23T13:50:56+00:00","2026-10-23T15:00:06.321211+00:00",8,[17,20,22,25],{"name":18,"type":19},"Fortinet FortiGate","product",{"name":21,"type":19},"Palo Alto Networks GlobalProtect",{"name":23,"type":24},"Firewalls","technology",{"name":26,"type":24},"VPNs","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":27,"icon":29,"name":30,"slug":31},null,"Breaches","breaches",[33,38,40,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21],{"controls":53,"vendors":136},[54,82,111],{"slug":55,"name":56,"problem":57,"products":58},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[59,66,74],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":55,"product_name":63,"url":64,"description":65},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":83,"name":84,"problem":85,"products":86},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":112,"name":113,"problem":114,"products":115},"patch-management","Automated patch management","Known holes get closed in days, not months.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":112,"product_name":133,"url":134,"description":135},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",[137,143],{"slug":138,"name":139,"logo_path":140,"roles":141},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png",[142],"affected",{"slug":144,"name":145,"logo_path":146,"roles":147},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[142],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":160},"70000-credentials-stolen-via-unpatched-edge-firewalls-and-vpns","70,000 Credentials Stolen via Unpatched Edge Firewalls and VPNs","Attackers exploited vulnerabilities in widely deployed network edge devices — Fortinet FortiGate and Palo Alto Networks GlobalProtect — to breach enterprise perimeters and harvest over 70,000 sets of credentials. These devices sit at the outermost layer of corporate networks, making them high-value targets whose compromise can grant attackers direct access to internal systems. The root cause lies in organizations failing to apply available patches and maintain rigorous vulnerability management for internet-facing appliances. This matters enormously because stolen credentials from perimeter devices can enable lateral movement, ransomware deployment, and prolonged undetected access across entire organizations.",[153,154,155,156,157,158,159],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","OWASP A06:2021 Vulnerable and Outdated Components","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":161,"NIST SP 800-53 SI-2: Flaw Remediation":162,"CIS Control 17: Incident Response Management":163,"OWASP A06:2021 Vulnerable and Outdated Components":164,"CIS Control 7: Continuous Vulnerability Management":165,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":166,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":167},"NIS2 mandates that essential entities implement vulnerability handling and patching policies; the failure to patch critical network edge devices represents a direct gap against this requirement.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined timeline — enforcing this for perimeter devices would have closed the attack window.","The scale of the breach and the ongoing attempts to further compromise victims highlight the need for a mature incident response plan capable of quickly detecting, containing, and remediating perimeter device compromises.","Running unpatched versions of enterprise firewall and VPN software is precisely what this category warns against, as known vulnerabilities in these components were the primary attack vector.","Regular, automated scanning and a disciplined patch cadence for internet-facing devices would have identified and remediated the exploited vulnerabilities before attackers could leverage them.","This control explicitly requires timely identification and remediation of technical vulnerabilities in assets, directly addressing the failure to patch the exploited firewall and VPN devices.","With over 70,000 credentials exposed, strong identity protections such as MFA on VPN and firewall management interfaces would have limited the impact of stolen credentials."]