top of page

Cyber Security Report -June 2026

  • 4 days ago
  • 12 min read

Research by OSINT Monitoring Team, NTT Security Japan K.K


Table Contents


This report selects and summarizes three particularly important topics from various incidents and events related to information security that occurred during June 2026, as well as the changes in the surrounding environment. The main points of each topic are as follows.


Chapter 1: 'Lessons from FortiBleed: Large-Scale Attacks on Authentication'

  • In June 2026, a major credential information breach related to Fortinet products (commonly known as "FortiBleed") was uncovered. Its impact has reached 194 countries worldwide, and public institutions have issued warnings about this serious incident.

  • The attack method was not to exploit new vulnerabilities, but rather to exploit known authentication information from past incidents and infostealers, using automated tools to repeatedly attempt authentication around the clock.

  • Companies need to continuously check and improve whether basic security measures, such as credential management and the introduction of multi-factor authentication (MFA), are being properly implemented


Chapter 2: 'Visitors to the Office: Cyberattacks That Never End Online'

  • Reports have been reported of the attacker group 'UNC3753' that steals confidential data through advanced social engineering impersonating IT support staff without using ransomware, then extorts money under the guise of disclosure.

  • If a remote intrusion fails, attackers have been confirmed to visit the office, directly access the terminal, and then use external storage media such as USB memory to retrieve data, prompting the FBI to issue warnings.

  • This case demonstrates that cyberattacks do not conclude solely online. Noting that situations where technical measures alone are no longer sufficient to defend against these issues, organizations are required to comprehensively review their security measures.


Chapter 3: 'Shift to Risk-Based Vulnerability Response as Shown by BOD 26-04'

  • On June 10, CISA issued BOD 26-04, requiring vulnerability responses to assess risks based on four factors: asset disclosure, known exploitation, possibility of attack automation, and technical impact, and to take corrective actions within the specified timeframe based on the results.

  • In recent years, in addition to the increase in vulnerabilities, attacks using AI have become more automated and faster, rapidly shortening the time from vulnerability disclosure to attack. Therefore, deciding which vulnerabilities to prioritize within limited resources has become an operational challenge.

  • BOD 26-04 aims to shift from a traditional comprehensive approach to an operation that specifies response details and deadlines according to risk, enabling risk-based decision-making to efficiently utilize limited resources.


Lessons from FortiBleed: Large-scale attacks on authentication


1.1. Overview


In June 2026, it was revealed that authentication credentials related to Fortinet products, including FortiGate, had been leaked on a large scale. This case was named "FortiBleed," and its impact has reached worldwide. Public institutions such as the US Cybersecurity and Infrastructure Security Agency (CISA) and Japan's JPCERT Coordination Center (JPCERT/CC) have also issued warnings, and the breach appears to be ongoing.[1], [2]


1.2. What is FortiGate

FortiGate is a network firewall product provided by Fortinet in the United States, holding over 50% of the global market share.[3]In addition to traditional firewall and VPN functions, it integrates multiple security features such as antivirus, web filtering, and intrusion prevention systems (IPS) as a UTM (Unified Threat Management) product.[4]It is widely used.


1.3. About FortiBleed


Case Overview


The incident came to light when security researcher Volodymyr "Bob" Diachenko discovered a server that was publicly available on the internet and checked a large number of Fortinet device-related credentials stored there. On June 13, when he reported this through his social media, several security companies also released their investigation results one after another.


Security officials have confirmed that the credentials discovered this time were actually verified by the attackers themselves, and that they contain valid usernames and passwords.


Note that "FortiBleed" is not the name of a vulnerability, but rather a large-scale attack campaign targeting Fortinet products to collect and verify large amounts of credentials and attempt unauthorized access, a name coined by cybersecurity company SOCRadar.


Figure 1: Excerpt from a post by Volodymyr "Bob" Diachenko
Figure 1: Excerpt from a post by Volodymyr "Bob" Diachenko


Attacker

SOCRadar analyzes that the attackers are likely from a Russian-speaking group, based on features seen in the tools, infrastructure configuration, and target selection used in FortiBleed.[6]


It also points out the connection between FortiBleed attackers and the ransomware groups INC and Lynx (Lynx may have been derived from INC). As evidence, the company cites that administrators of FortiBleed-related infrastructure accessed both INC and Lynx ransomware ransom negotiation sites and interacted with victims.[7]


Since around 2023, INC/Lynx has been targeting organizations in healthcare, education, government, and manufacturing, mainly in North America and Europe.


This time, from FortiBleed-related servers that were publicly available, VPN credentials believed to belong to the defense industry were also discovered, suggesting that the attackers' objectives may go beyond financial gain.


Scale of Damage

A total of 86,644 compromised devices were identified, with over 80,000 IP addresses and over 20,000 domains identified. The impact has reached 194 countries, with India and the United States accounting for about one-third of the damage. The victim organizations also include large corporations with revenues exceeding $1 billion, as well as numerous government agencies.


Attack Methods

The attack proceeded in the following manner.


Step 1: Collect Credentials

Attackers collected credentials leaked from past Fortinet-related incidents (such as those caused by authentication evasion vulnerabilities) or stolen by infostealers (information-stealing malware).


Step 2: Automated Authentication Trial Campaign

The attackers automated logins to FortiGate devices and verified credentials 24/7 from numerous sources. As a result, it is said that over 1.1 billion logins were tried against approximately 320,000 FortiGate devices.[8]


According to SOCRadar's research, many victim organizations had not changed the default account name or initial password for the device involved. Additionally, Fortinet speculates that devices without multi-factor authentication (MFA) have been targeted.[9]


On the other hand, many very complex passwords were leaked in this case (see Figure 2). Even if strong passwords are used, if attackers rely on known credentials, the complexity of the passwords alone is not sufficient defense. MFA is extremely important as a countermeasure against unauthorized logins, as a precaution against unauthorized logins in case your company's credentials have been compromised.


Figure 2: Example of a complex password contained within compromised credentials
Figure 2: Example of a complex password contained within compromised credentials


Step 3: Analyze the encrypted password

After successful access, the attackers exported the configuration files of Fortinet devices and extracted the encrypted passwords contained within. At that time, many devices were using outdated encryption algorithms, making them extremely vulnerable to password breaking.

[10]

Fortinet introduced PBKDF2, a more secure encryption algorithm, in early 2025, but this method was not effective simply by updating the firmware; administrators had to log in again. As a result, many devices stored passwords in outdated formats that were easy for attackers to analyze.


Step 4: Passive Harvesting (Passive Authentication Collection)

The attackers not only used the compromised FortiGate as a mere entry route, but also intercepted communications passing through the device and collected the credentials contained in the communications. At the time of interception, the credentials were encrypted but decrypted using 45 GPU clusters (environments that link numerous GPU servers to perform massive computations at high speed).


1.4. Summary

FortiGate was the primary target in FortiBleed, but the attackers targeted Sophos products[11]and Microsoft SQL Server (MSSQL), indicating that any public system can be targeted.


This case once again highlights the importance of basic security measures such as managing credentials and implementing MFA. In systems exposed to the internet, it is assumed that authentication relying solely on IDs and passwords will be compromised, so organizations need to regularly check and improve whether security measures are properly implemented.

[1] Source: JPCERT/CC "Warning Regarding Credential Leakage Related to Fortinet Products"https://www.jpcert.or.jp/at/2026/at260019.html

[2] Source: CISA 'CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure'https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-urges-hardening-fortinet-devices-after-reports-credential-exposure

[3] Source: Fortinet 'Next-Generation Firewall (NGFW)'https://www.fortinet.com/jp/products/next-generation-firewall

[5] Source: LinkedIn 'Volodymyr "Bob" Diachenko: Fortinet FortiGate Bruteforce Campaign Exposed'https://www.linkedin.com/posts/vdyachenko_massive-fortinetfortigate-bruteforceactive-activity-7471222472193830913-YBDi

[6] Source: SOCRadar 'FortiBleed Breach How 80,000+ Corporate Firewalls Were Quietly Compromised'https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/

[7] Source: SOCRadar 'Is FortiBleed Linked to INC and Lynx Ransomware?' All You Need to Know』https://socradar.io/blog/fortibleed-inc-lynx-ransomware-link/

[8] Source: HudsonRock 'FortiBleed: 75,000 Fortinet Firewalls Compromised: Global Enterprises Exposed – Claim Your Ethical Disclosure'https://www.hudsonrock.com/blog/fortibleed-75000-fortinet-firewalls-compromised-global-enterprises-exposed-claim-your-ethical-disclosure

[9] Source: Fortinet 'Analysis of Reported Credential Compromise of FortiGate Devices'https://www.fortinet.com/blog/psirt-blogs/analysis-of-reported-credential-compromise-of-fortigate-devices

[10] Source: DoublePulsar 『FortiBleed — 75k Fortinet firewalls have admin passwords cracked』https://doublepulsar.com/fortibleed-75k-fortinet-firewalls-have-admin-passwords-cracked-60299faa65f8

[11] Source: Sophos 'Advisory: Fortinet "FortiBleed" Credential Exposure and Sophos VPN Bruteforcing Campaign'https://www.sophos.com/en-us/security-advisories/fortinet-fortibleed-credential-exposure-and-sophos-vpn-bruteforcing-campaign


Office Visitors: Cyberattacks That Never End Online


2.1. Overview

On June 6, Mandiant, Google's threat intelligence division, reported a large-scale data theft and extortion campaign by the attack group "UNC3753," targeting U.S. law firms, financial institutions, and professional services firms.[12]


This campaign has confirmed cases of intrusions not only using phone calls and remote tools but also attempts to break in physically through face-to-face contact.


2.2. About UNC3753

UNC3753 is a financially motivated group that began activities in March 2022,[12]


There is speculation that it may be based in Russia. [13]


The main targets are U.S. law firms and similar entities.


This group is also known as the "Silent Ransom Group (SRG)", [12]


This term succinctly illustrates the characteristics of the attack method. Initially, ransomware was used to encrypt files (data) of the target organization, but now it neither encrypts files nor shuts down systems. They have shifted to a method where only confidential data is silently stolen and then published on exposé sites operated by the company to demand ransom payment. Since the start of its activities, no arrests have been made, and no attacks on servers or other infrastructure have been prosecuted.[13]


Figure 3 UNC3753 Exposé Sites
Figure 3 UNC3753 Exposé Sites

2.3. Details of published cases of active cyber operations

Of the proactive cyber operations conducted in fiscal year 2025, CSE has disclosed three cases.


For a while after its inception, the method used by the group was relatively simple: sending emails disguised as "subscription renewal notifications" to employees of the target organization, who then contacted the phone number listed in the email.[12]Recently, this has evolved into more advanced social engineering, combining phones and remote tools.


Attack Procedure from a Distance

STEP 1: Instill vigilance with fake emails

Attackers first send harmless emails disguised as invoices. This email contains no malicious links or attachments. The goal is to raise security concerns for employees who receive emails with unfamiliar content, preparing them to avoid suspicion against subsequent fake calls.


STEP 2: Phone calls disguised as IT support (Vishing: a tactic to trick the other party into operating systems or providing information)

An attacker impersonating IT support calls an employee (the recipient of the email sent in STEP 1). Using support for email handling and data migration as a pretext, employees gain trust and encourage them to install tools that enable remote access and screen sharing. Because it uses legitimate tools like Zoom, Microsoft Teams, and Quick Assist, which are widely used in regular operations, employees are less likely to become suspicious. The group is believed to be operating a call center systematically staffed by native English-speaking staff.[13]They are impersonating the IT staff of the target organization without any linguistic or geographic distance.


STEP 3: Searching for and stealing confidential data

Once access to an employee's device is established, attackers search for, collect, and steal highly sensitive data within the organization, such as contracts, personal information, financial records, and tax papers. In one case, 1.7 gigabytes of data from the targeted employee's OneDrive folder were sent to the attacker's Google Drive account, followed by the theft of an additional 14.4 gigabytes of data via a virtual desktop environment.


STEP 4: Sending threatening emails

Within just 30 minutes of completing the data theft, they send extortion emails to the victim organization to obtain the ransom. The document not only threatened that if there is no contact within three days, employees and business partners will be notified directly and data will be published on the exposé site, but it also mentioned risks of hefty fines from regulators or lawsuits from customers. Furthermore, the content is extremely aggressive, even stating that this matter threatens the survival of the organization.


Figure 4: Example of a UNC3753 extortion email (partial)
Figure 4: Example of a UNC3753 extortion email (partial)

[Time Required for Attack]

According to Mandiant's report, there have been numerous cases where the entire process from initial contact with employees to stealing confidential data and sending extortion emails was completed within one business day, with some cases where data was stolen within just one hour.[12]


2.4. Expansion of Attacks: Intrusions Involving Face-to-Face Contact


If remote intrusions using telephone or remote tools fail, the group attempts face-to-face contact with the target organization. This method involves individuals claiming to be IT engineers or technical support staff who actually visit the offices of the target organizations.[14]


There have been cases where employees were informed that device checks or backups were necessary to address the impact of phishing emails, accessed the device on the spot, and retrieved data using external storage media such as USB memory sticks. On May 26, the FBI also issued a warning about this tactic.


Security researchers have pointed out that the group may be able to visit the target organization's office in countries different from UNC3753 bases, and that the group may be utilizing gig workers (individual workers who take on short-term, one-off tasks via the internet), and the office visitors themselves It is believed that some people are not aware that they are complicit in crimes.[15]


2.5. Summary

This case shows that cyberattacks are no longer limited to being completed online. Attacks carried out beyond limitations such as language and geographic distance are affecting the real world, and situations are emerging where technical measures alone are no longer sufficient to defend against them. While technical defenses such as monitoring logs and endpoints are becoming more advanced, access control for facilities like offices still heavily depends on human procedures. It is also important to be mindful of the possibility that attackers exploit such defensive gaps and resort to additional measures such as physical intrusion. Based on the above, organizations are required to comprehensively review their security measures.

[12] Source: Google Cloud 'Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms'https://cloud.google.com/blog/topics/threat-intelligence/targeted-campaign-us-law-firms?hl=en

[13] Source: Halcyon 'THREAT ACTOR Silent'https://www.halcyon.ai/threat-group/silent

[14] Source: FBI FLASH 'Silent Ransom Group Impersonating IT Personnel through Social Engineering'https://www.ic3.gov/CSA/2026/260526.pdf

[15] Source: CyberScoop, 'FBI warns US-based law firms to be on the lookout for cybercrime group that steals data in person'https://cyberscoop.com/fbi-warning-silent-ransom-group-law-firms/

The shift toward risk-based vulnerability response as shown by BOD 26-04


3.1. Overview

On June 10, 2026, CISA (U.S. Cybersecurity and Infrastructure Security Agency) issued operational directive "BOD 26-04." This directive requires U.S. federal agencies to prioritize vulnerability responses and remediation deadlines based on risk and take corrective actions within those deadlines. Unlike the previously widely used comprehensive vulnerability response centered on CVSS scores, it requires dynamic risk assessment based on four factors: asset disclosure, known exploitation, possibility of attack automation, and technical impact.[16]


3.2. Shift to Risk-Based Vulnerability Management


Challenges in Vulnerability Management with CVSS

Until now, CVSS (Common Vulnerability Scoring System) has been widely used as an international benchmark for assessing the severity of vulnerabilities and has been continuously improved. However, in recent years, in addition to the increase in vulnerabilities, attacks using AI have become more automated and faster, rapidly shortening the time from vulnerability disclosure to actual exploitation. Therefore, prioritizing responses within limited resources has become a critical challenge for organizations.


Evaluation by SSVC

To address these challenges, SSVC (Stakeholder-Specific Vulnerability Categorization) has been proposed as a framework for realizing risk-based decision-making.

[17]


SSVC defines stakeholders (the entities making decisions regarding vulnerability response) as Deployers that implement vulnerability responses, Suppliers who provide products or services, and Coordinators responsible for sharing and coordinating vulnerability information. Each stakeholder determines the priorities of vulnerability response according to their respective positions and responsibilities.



3.3. Operating Model of BOD26-04


BOD 26-04

BOD 26-04 is a directive institutionalized by CISA to suit operational needs for U.S. federal agencies, based on SSVC's risk-based vulnerability assessment and decision-making approach. To enable rapid and consistent decision-making across federal agencies, evaluation items are standardized, and deadlines for response based on assessment results are clearly defined.


Evaluation Method

While SSVC serves as a general-purpose framework to support stakeholder decision-making by combining multiple evaluation factors in a decision tree format to derive response policies, BOD 26-04 significantly simplifies the evaluation methodology and assumes operation in federal agencies.For example, SSVC's decision model for deployers evaluates exposure on three levels, exploitation at three levels, automatable attacks at two levels, and human impact on four levels, achieving a 3×3×2× Decisions are made in 4 combinations (72 ways).


In contrast, BOD 26-04 considers SSVC's risk-based decision-making concepts and covers "Asset Exposure," "Known Exploit Status," "Exploit Automation," and "Technical Impact." Each of these four elements is evaluated in two stages, and the response deadline is determined based on 16 classifications (2×2×2×2). This design is considered to prioritize rapid and consistent decision-making over detailed evaluations through complex branching, assuming practical operation in federal agencies.


Additional Measures for High-Risk Cases

BOD 26-04 sets response deadlines and also provides additional measures for certain high-risk cases. Specifically, if a potential breach is determined, "forensic triage" (confirming the presence or absence of a breach) is conducted to check for impact on systems and network infrastructure, as well as the presence of breaches. If a breach is confirmed at this stage, the process moves to incident response.[19]


3.4. Summary

BOD 26-04 can be seen as an initiative that concretizes SSVC's risk-based decision-making approach in a way suitable for practical use by federal agencies. By combining a simple evaluation model using four evaluation criteria with clear response deadlines, it supports prioritizing rapid vulnerability responses. In today's world, where vulnerabilities are increasing and attacks are becoming more automated, such risk-based operating models are expected to offer valuable insights not only to federal agencies but to many organizations.

[16] Source: CISA 'BOD 26-04: Prioritizing Security Updates Based on Risk'https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk

[17] Source: Carnegie Mellon University Software Engineering Institute CERT Coordination Center (CERT/CC) 'What is SSVC?'https://certcc.github.io/SSVC/tutorials/ssvc_overview/

[18] Source: Information-technology Promotion Agency (IPA), 'Summary of Risk Assessment Methods in Vulnerability Response ver1.1'https://www.ipa.go.jp/jinzai/ics/core_human_resource/final_project/2024/f55m8k0000003v30-att/f55m8k0000003v94.pdf

[19] Source: CISA 'BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk'https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk

  1. Disclaimer

Please note that while we do our best to ensure that the content of this article is accurate, we do not guarantee the content and do not compensate for any damages or losses incurred as a result of the use of this article. If you have any inquiries such as typographical errors, content errors, or other points in the article, please contact us at the following address.


Inquiries

NTT Security Japan Corporation

Professional Services OSINT Monitoring Team

 
 
bottom of page