FortiBleed: Giant FortiGate VPN Brute‑Force Campaign Hijacks AD via SSL Cookie Replay
Researchers uncovered a coordinated operation that launched 1.16 billion login attempts against 320 k FortiGate appliances, cracked NTLM/Kerberos hashes on a 45‑GPU RTX 4090 cluster, and replayed VPN cookies to infiltrate Active Directory. The scale shows how attackers can turn credential‑spraying into full network compromises, forcing defenders to rethink VPN exposure.