Security teams spent the week ending October 25 scrambling to contain one of the broadest credential-theft campaigns seen against enterprise network perimeters in months. Researchers at Group-IB and NyxLab disclosed that attackers systematically targeted exposed Fortinet FortiGate firewalls and Palo Alto Networks GlobalProtect VPN gateways, harvesting more than 70,000 login credentials and establishing persistent footholds inside multiple organizations. The campaign unfolded alongside a cluster of emergency disclosures affecting Arista's VeloCloud Orchestrator, Collabora Online, PHP, and GitLab, all of which CISA flagged as actively exploited in the wild. Together, the incidents underscore how edge devices meant to secure corporate networks have become the primary battleground for attackers.
The convergence of these events is not coincidental. Firewalls and VPN concentrators sit at the exact chokepoint attackers need to breach before moving laterally into corporate networks, and a single stolen credential set can unlock access that persists for months. With CISA's Known Exploited Vulnerabilities catalog growing by the week and evidence that compromised credentials are already being used for data exfiltration, the FortiGate and GlobalProtect campaign represents a worst-case scenario: not a single zero-day, but a coordinated harvesting operation spanning the devices that most enterprises depend on to keep attackers out in the first place.
A Credential Harvest at Internet Scale
The Group-IB and NyxLab findings paint a picture of an opportunistic but highly effective operation. Attackers scanned for internet-exposed FortiGate firewalls and GlobalProtect VPN portals, extracted authentication data, and in many cases retained the ability to log back in using stolen credentials long after initial compromise. The scale, more than 70,000 exposed credentials, suggests an automated or semi-automated collection pipeline rather than manual, targeted intrusion.
What makes the campaign especially dangerous is what came after the initial theft. Investigators found evidence of attempted lateral movement and data exfiltration inside affected organizations, meaning the stolen credentials were not simply collected and sold, but actively used to escalate access deeper into corporate environments. For security teams, this raises the stakes of incident response considerably: a compromised VPN credential is no longer just a login risk, it is a potential entry point into the broader network.
Fortinet's Troubled Week Deepens
Fortinet's products featured prominently in multiple incidents this week, independent of the credential-harvesting campaign. Researchers disclosed that a threat actor exploited CVE-2025-61624, a path-traversal vulnerability carrying a CVSS score of 5.4, to deploy a previously undocumented memory-resident ARM64 malware strain called PEERSTITCH. The flaw affects FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, and while its severity score is comparatively modest, it permits privileged attackers to write or delete files, a capability that proved sufficient for establishing stealthy, hard-to-detect persistence.
The appearance of PEERSTITCH alongside the GlobalProtect and FortiGate credential campaign illustrates a broader pattern: attackers are not waiting for critical-severity bugs to cause damage. Medium-severity flaws, when chained with stolen credentials or combined with custom malware, can deliver outcomes just as damaging as a headline-grabbing zero-day. Fortinet has not indicated the two incidents are directly linked, but the overlap in affected product lines has heightened concern among administrators running FortiOS infrastructure at the network edge.
A Pile-Up of Actively Exploited Flaws
The credential campaign landed amid an unusually dense stretch of emergency disclosures. Arista issued an advisory on October 22 for a critical SQL-injection zero-day in its VeloCloud Orchestrator SD-WAN management platform, which allows unauthenticated attackers to obtain operator-level access to privileged internal functionality. CISA added the flaw to its Known Exploited Vulnerabilities catalog almost immediately, a signal that exploitation was already underway rather than theoretical.
Separately, CISA listed CVE-2026-110447, a 9.2-severity command-injection vulnerability in Collabora Online's CODE Server when integrated with Nextcloud, exploitable through the proxy.php endpoint. Two additional PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, also scored 9.2 and were disclosed as unauthenticated remote-code-execution bugs after a leak reportedly disrupted the coordinated disclosure embargo. Researchers observed attempts to use the PHP flaws to recruit compromised systems into Potassium, a Mirai botnet variant, though successful compromise was not confirmed across every observed campaign.
Rounding out the week, a critical GitLab remote-code-execution vulnerability was found to affect self-managed server releases dating back to 2014, exposing a deep and largely unpatched installed base. Hewlett Packard Enterprise, meanwhile, issued fixes for 72 ArubaOS vulnerabilities, including eight rated maximum severity for authentication bypass and code execution, giving network administrators yet another large patch queue to work through in the same week.
Breaches Compound the Pressure
The vulnerability pile-up was matched by a run of confirmed data breaches. Japanese game publisher Capcom disclosed that attackers breached its CAPCOM ID membership service, exposing more than 11.7 million customer email addresses and related account information, with attackers successfully changing passwords on 196 accounts. Separately, U.S. clinical laboratory operator Quest Diagnostics disclosed unauthorized access to its Quanum LSM system, exposing patient records, though the company has not specified the total number of individuals affected.
On the software supply-chain front, attackers compromised the LiteLLM Python package on PyPI and distributed malicious Docker images designed to steal credentials, secrets and environment variables, creating acute risk for AI and cloud-development pipelines that pull the package automatically. An Indian certificate authority, eMudhra, also reportedly exposed private keys, raising questions about the integrity of certificates it has issued and whether affected customers will need to replace them. Each incident on its own might be contained; together, they represent a week in which attackers found success across network infrastructure, consumer platforms, healthcare systems, and software supply chains simultaneously.
Treat CISA KEV additions as urgent remediation items because they indicate exploitation in real-world attacks, not theoretical risk.
What Defenders Need to Do Now
Security teams facing this volume of simultaneous threats need to triage ruthlessly. Patching or isolating Arista VCO, Collabora and Nextcloud integrations, PHP installations, GitLab self-managed instances, ArubaOS deployments and Fortinet products should take immediate priority, given that each has either confirmed active exploitation or a CISA KEV listing. Equally important is a thorough audit of firewall and VPN logs for suspicious administrator activity, newly created accounts, anomalous credential use, and unexplained outbound data transfers, since the FortiGate and GlobalProtect campaign demonstrates that stolen access can sit dormant before being weaponized.
Organizations using the LiteLLM package should rotate any credentials or secrets that may have passed through compromised builds, while affected CAPCOM ID and Quest Quanum LSM users should watch for password-reset notices and unusual account activity. The breadth of this week's incidents, spanning edge devices, cloud software, gaming platforms and healthcare systems, is a reminder that attackers are not waiting for the single largest vulnerability to strike. They are working through whatever exposed, unpatched or improperly secured systems are available, and the organizations that respond fastest to CISA's KEV updates will be the ones that avoid becoming next week's breach headline.
Sources
- https://thecyberwire.com/
- https://thehackernews.com/search/label/Cyber%20Attack
- https://thehackernews.com/search/label/data%20breach
- https://www.bleepingcomputer.com/
- https://www.bleepingcomputer.com/news/security/
- https://research.njit.edu/cybersecurity/aggregator/sources/1
- https://thehackernews.com/search/label/network%20security?max-results=20&m=1&hl=en_GB
- https://www.techtarget.com/cybersecurity/info/news
- https://research.njit.edu/cybersecurity/aggregator/sources/1?page=10
- https://www.securityweek.com/
- https://ai-tldr.dev/releases/security/
- https://ground.news/article/google-hackers-used-ai-to-develop-zero-day-exploit-for-web-admin-tool
Leave a Comment