SOCshare June 2026: cybersecurity landscape review

‘FortiBleed’: 86,644 compromised ‘Fortinet’ firewalls

The most notable discovery of the month was made by SOCRadar researchers, who gained access to an active campaign called ‘FortiBleed’ through an insecurely open attacker server. It contains 86,644 (identified in over 194 countries) Fortinet firewall and VPN device logins, from banks and telecommunications operators to hospitals, universities and government agencies.

The most interesting thing is that this is not a zero-day attack. The campaign, which has been active since at least February, relies on two interdependent stages. The first stage involves credential reuse: passwords obtained from previous Fortinet leaks and infostealer logs are automatically and continuously checked against open devices. The second stage is passive collection: the compromised device is converted into a listening post that monitors the VPN traffic passing through it and collects new credentials, which are sent back to the scanner.

Analysis revealed an unpleasant truth: a large proportion of stolen logins consisted of shared administrator and factory-default “Fortinet” system accounts – many organisations never changed them, and the passwords remained unchanged even after previous leaks. SOCRadar attributed the campaign to the “Lynx/INC” ransomware group, and the assessment is clear: organisations that appear on the list should consider their perimeter already compromised.

‘Atomic Arch’: over 400 ‘Arch Linux’ packages were taken over

The second major story hit the developers’ community. From 11 June, attackers took over more than 400 abandoned packages in the community-based ‘Arch User Repository’ (AUR) repository – such packages have no active maintainers, so anyone can ‘adopt’ them. To avoid arousing suspicion, they forged the ‘git’ history, imitating the work of a long-term maintainer, and inserted malicious code into the package creation scripts. The result: each computer that compiles such a package unnoticeably installs the ‘infostealer’. The official “Arch Linux” repository was not affected – the attackers exploited not a software vulnerability, but the AUR trust model itself.

The Rust-written code targeted the creators’ assets specifically: browser cookies and session tokens, GitHub, npm and SSH keys, Docker and OpenAI access data. When run with root privileges, it would install the eBPF rootkit, hiding its processes from standard tools – therefore, simply deleting the package is not enough; it is recommended that the infected system be re-installed from a reliable source. The campaign was named ‘Atomic Arch’ by the Sonatype researchers.