FortiBleed IAB Identified, Gravity SMTP 17M+ Blocks, ShinyHunters Hits IC Security, CryptoBandits Tor Backdoor, Thailand Healthcare Campaign

Unit 42's independent analysis of FortiBleed is the day's defining story because it reframes the leak as an active intrusion pipeline. The campaign runs internet-wide password spraying built from prior breaches against Fortinet, Sophos, and MSSQL services, and an initial access broker on a Russian-language forum is selling harvested credentials. Insikt Group recovered artifacts matching a full credential-harvesting workflow, from sniffing logs to Active Directory enumeration scripts. The FortiBleed analysis confirms the 73,932 exposed FortiGate URLs are an ongoing supply of access, not a historical data point.

The Gravity SMTP exploitation is the second headline. CVE-2026-4020, a CVSS 5.3 unauthenticated information disclosure in a WordPress plugin with over 100,000 active installs, has drawn more than 17 million Wordfence blocks. The exposed endpoint leaks API keys, OAuth tokens, and database configuration, enabling email impersonation and reconnaissance; rotate exposed credentials and update to 2.1.5 or later.

Klue's CEO confirmed the OAuth breach stemmed from a compromised legacy credential, Huntress confirmed data theft, and Salesforce disabled the integration platform-wide. ShinyHunters set a June 22 leak deadline for 2.7 million records it claims from security vendor IC Security, a compromise with supply-chain implications for its clients. Microsoft detailed CryptoBandits, a Tor-backed clipper that doubles as a backdoor, and Seqrite documented a RAR-based chain targeting Thailand's healthcare sector.

Watchlist: enforce MFA and credential rotation on Fortinet and Sophos edges, patch Gravity SMTP, audit Salesforce OAuth integrations, and monitor for local SOCKS proxy on port 9050.