FortiBleed Targeted At Least 13,000 Fortinet Devices, Lumen Tells CINI

Estimated reading time: 8 minutes

At least 13,000 Fortinet targets drew fire in the FortiBleed campaign, Lumen told CINI. Its new Black Lotus Labs report finds attackers moving before vendors disclose flaws. Botnets rebuild after takedowns. Lumen’s answer is a checklist of numbers for the board.

Lumen released a mid-year update to its Threatscape Report on Nov. 10. Black Lotus Labs, its threat research team, wrote it for chief information security officers. Lumen sells network security services, including Lumen Defender, managed detection and response, and DDoS mitigation. The report closes with recommendations for Lumen customers.

Lumen says its backbone gives it visibility into 99% of public IPv4 addresses. It monitors more than 315 billion NetFlow sessions a day, it says.

The report’s theme is speed. AI and automation are compressing every step from finding a flaw to cashing in on it, Lumen writes. Attackers then rebuild what defenders take down.

FortiBleed: Machine-Speed Attacks On Edge Devices

Black Lotus Labs spotted the FortiBleed cluster on April 13. A group of IPs kept hitting the same Fortinet endpoints. One Lumen customer took more than 480,000 login attempts on its VPN management interface. All were blocked automatically, the report says.

Over three weeks, the operation targeted more than 10,000 Fortinet endpoints, the report says. It generated more than 65 million attacks. Lumen gave CINI a larger count in written answers.

Some Fortinet endpoints took tens of thousands of login attempts a week, Lumen said. Those came from more than 100 attacker IPs tied to the campaign. “At least 13,000 Fortinet targets were targeted by at least 100 FortiBleed-related attackers,” Lumen said.

Later research found the attackers used two AI tools. One was Cursor, an AI-based code editor. The other was CyberStrike, an agentic penetration-testing framework. The attackers used them to build custom tooling and automate intrusions, the report says. A new wave started on June 12 with more than 100 new IPs.

On June 13, a security researcher reported more than 80,000 stolen Fortinet credentials. The activity was later linked to INC and Lynx ransomware operators, the report says, citing SpyCloud.

Fortinet saw old weaknesses at work. Its assessment found the attackers reused credentials from earlier incidents. They went after devices with weak passwords and no MFA, as Acronis noted in its new threat report.

Lumen counted targets rather than organizations. CINI also asked whether any targeted organization went on to suffer a ransomware attack. Lumen did not say.

Pre-Disclosure Exploitation Breaks The Patch Clock

Mandiant’s M-Trends 2026 put the mean time to exploit at minus seven days, the report notes. On average, attackers exploit a flaw before it becomes public.

Black Lotus Labs saw the same pattern on the network. On May 13, its automated detection flagged an IP address talking to CheckPoint VPN services. Lumen blocked it for Defender customers right away.

CheckPoint identified a flaw in its own systems on June 4. It tied the same IP to a small exploitation cluster. On June 8, CheckPoint published indicators and linked the activity to Qilin ransomware deployment. Lumen’s block came more than three weeks before CheckPoint identified the flaw.

Disclosure starts its own race. Dedicated exploit servers began targeting Ivanti Connect Secure within 24 hours of the CVE-2026-10520 disclosure, Black Lotus Labs found. Within 72 hours, more than 100 dedicated servers were targeting Ivanti services.

Patch deadlines usually start at publication. That leaves the days before disclosure uncovered. CINI saw the same gap when AhsayCBS backup servers were attacked before a complete fix existed. Speed after disclosure is uneven too. The median Moody’s-rated company takes 87 days to fix half of its known exploited flaws, CINI reported.

Some insurers already act on live threats. Coalition alerts policyholders to zero-days under active attack.

CINI asked Lumen how often its blocks come before public disclosure. It also asked what patch window Lumen’s data supports for internet-facing systems. A reply is awaited.

Botnet Takedowns Don’t Hold For Long

IPIDEA is a large proxy botnet. Google disrupted it earlier this year. The network lost more than half its observed proxies, the report says. It fell from a January peak of roughly 8 million bots to 4 million.

It recovered within about 36 hours to roughly 5 million proxies. Reselling proxies helped, Lumen found. In under six months, IPIDEA had rebuilt to nearly 112% of its pre-disruption level.

Recruitment is speeding up too. Earlier in 2026, Black Lotus Labs saw fewer than 10,000 potential new proxies a day contacting malicious Android app hosts. By mid-year, the count topped 40,000 a day.

The Aisuru DDoS botnet spiked in July despite coordinated action by law enforcement, Black Lotus Labs and private partners. For a business, a rebuilt DDoS botnet is an outage risk. Lumen advises teams to assume DDoS capacity can re-form.

“Adversaries are becoming more resilient in their architecture and orchestration, requiring defenders to use a multi-layered approach for threat detection,” Lumen told CINI.

Lumen says takedowns are not futile. CISOs should assume malicious infrastructure can reappear, rotate, or be replaced, the report says.

The pool reaches inside companies. The report warns that employee phones, retail IoT and routers can join proxy networks unnoticed. CINI asked how often Lumen sees corporate IP space inside those pools. “We have clear evidence of corporate network compromise,” Lumen said. It did not give a frequency.

Supply Chain Attacks And Accumulation Risk

One upstream compromise can create risk for hundreds or thousands of downstream customers, the report says. Two 2026 cases show the scale.

A group called TeamPCP poisoned Trivy, a widely used vulnerability scanner. The poisoned version stole credentials from its users. TeamPCP used those credentials to poison more developer tools, including the AI gateway LiteLLM. Credentials were passed to ransomware actors, including Vect. In total, the campaign took 300 GB of data, including an estimated 500,000 credential sets.

The report gave no count of Trivy victims. CINI asked whether Black Lotus Labs could measure the spread. Lumen pointed to FBI reporting of “likely thousands” of victims.

In May, the ShinyHunters extortion group got into Canvas, the learning management system used by thousands of schools. ShinyHunters extorted the parent company. It also tried to extort the more than 9,000 schools whose data was exposed, the report says. The group then published a complete list of affected Canvas customers “as a step beyond extortion,” Lumen told CINI.

Education shows how one breach spreads. GuidePoint’s research team tracked six more education technology platforms hit by six separate groups after Canvas, CINI reported. Insurers cannot yet see that kind of aggregation, Nudge Security’s Russell Spitler told CINI.

The same software sits inside schools, banks and manufacturers alike. Vect’s claimed victims include a global provider of financial information and market analytics, the report says.

Board KPIs Read Like A Cyber Insurance Application

The report ends with an H2 2026 checklist. It pairs eight priorities with “KPIs to the Board”:

• Administrative access: MFA coverage; exposed admin interfaces.
• Patch exposed systems: SLA compliance; time to patch.
• Retire unsupported edge devices: percentage of IT-supported assets.
• Reduce external exposure: owned assets; external exposure.
• Review logs and traffic flows: logging coverage; use cases tested.
• Correlate control layers: cross-domain investigations; time to block.
• Plan for DDoS: exercise date; mitigation readiness.
• Prepare for extortion and supply chain compromise: tabletop results; decision owners.

At least five of the eight map to broker Marsh’s 12 key cyber controls. Those include MFA, patching, end-of-life systems, logging and incident response planning.

The KPIs ask for measures rather than yes-or-no answers. That matters for MFA. Yes answers on Marsh’s MFA question have neared 90% to 100%, CINI reported. A coverage percentage says more than a tick box.

Boards already watch insurability. In PwC’s survey, 42% of CEOs and board members ranked insurance premium trends and insurability among their top metrics.

Lumen’s bottom line frames the problem as a mismatch. “Cyber risk is increasingly a contest between continuous adversary operations and periodic defensive processes,” the report says. Cyber Tzar’s Andrew Horkan made the same case on the CINI podcast: Compliant In May. Seventeen Thousand Open Ports In June.

CINI asked whether insurers or brokers ask Lumen customers for these KPIs. It also asked which one best predicts a compromise in Lumen’s data. A reply is awaited.

FAQ – FortiBleed

What is FortiBleed?

FortiBleed is a 2026 campaign against Fortinet devices. Black Lotus Labs detected it on April 13. At least 13,000 Fortinet targets drew attacks, Lumen told CINI.

Did attackers use AI in FortiBleed?

Later research found they used the AI code editor Cursor and the agentic framework CyberStrike to build tooling and automate intrusions, the report says.

What is pre-disclosure exploitation?

Attacks on a flaw before the vendor discloses it. Lumen blocked an IP targeting CheckPoint VPNs more than three weeks before CheckPoint identified the flaw.

Do botnet takedowns work?

They help, but networks rebuild. The IPIDEA botnet reached nearly 112% of its pre-disruption level in under six months, Lumen found.

Why do supply chain attacks matter for cyber insurance?

One upstream breach can reach thousands of customers at once. Lumen pointed to FBI reporting of likely thousands of Trivy victims.

What board KPIs does Lumen recommend?

Its checklist includes MFA coverage, exposed admin interfaces, time to patch, logging coverage and tabletop results, among others.

Related Cyber Insurance Posts

• Ransomware Crews Switch Off Security Tools Before They Encrypt, Acronis Finds
• Manufacturing Cyber Insurance: What Five Years Of Claims Data Tells Underwriters(Opens in a new browser tab)
• Nozomi Report: Ransomware Concentrates In English-Speaking Markets With 70% Share(Opens in a new browser tab)
• Lumen Warns Edge Device Security Risks Now Define Cyber Risk Exposure(Opens in a new browser tab)
• Ransomware Accelerated 60% in Six Months. The Exposure Outlived the Claim(Opens in a new browser tab)