Today’s Topics:

• BioShocking Shows Why AI Browsers Turn Prompt Injection Into Account Access
• FBI Seizure of NetNut Shows How Residential Proxies Turn Home Devices Into Cybercrime Infrastructure
• How can Netizen help?

BioShocking Shows Why AI Browsers Turn Prompt Injection Into Account Access

AI browsers change the risk model for web security. A normal browser displays pages, runs site code inside web security boundaries, and leaves most decisions to the user. An AI browser in agent mode can read, click, type, summarize, follow links, interact with signed-in services, and make task-level decisions inside the user’s active session. That means prompt injection is no longer just a model-behavior issue. It becomes an identity and access issue.

LayerX’s BioShocking research, published on June 29, 2026, demonstrates that problem through a proof-of-concept attack against six agentic browsers and assistants: ChatGPT Atlas, Perplexity Comet, Fellou, Genspark Browser, Sigma Browser, and Anthropic’s Claude Chrome plugin. The attack does not rely on a memory corruption bug, stolen cookies, or malware. It relies on the agent accepting a manipulated operating context and then treating dangerous instructions as part of a task it is supposed to complete.

The proof of concept was built as a BioShock-themed puzzle page. The agent is pushed into a false set of rules where incorrect answers are rewarded, such as accepting that 2 + 2 = 5. Once the agent adapts to that logic, the page asks it to continue the “game” by visiting a path that redirects to the victim’s work GitHub repository and copying sensitive SSH login credentials. LayerX says all six tested agents failed to identify the final step as a guardrail violation.

The important detail is not the game theme. The important detail is that the malicious page and the user’s task arrive to the model as context the agent must interpret. That is the core failure behind indirect prompt injection: untrusted page content becomes operational instruction. OWASP’s 2025 LLM guidance lists prompt injection as LLM01 and describes it as manipulation of model behavior through crafted inputs that can cause unauthorized access, data exposure, and unsafe decisions.

BioShocking is part of a broader pattern in agentic browser research. Brave disclosed an earlier indirect prompt injection issue in Perplexity Comet where malicious content in a web page could be processed by the assistant as instruction. In Brave’s demonstration, the assistant could move across authenticated sessions and retrieve information from services such as Gmail, exposing the limits of traditional browser security assumptions when an AI agent acts with user-level reach across sites.

Guardio’s “Scamlexity” testing reached a similar conclusion from a scam and phishing angle. In its tests, agentic browsers interacted with fake shops, phishing pages, and hidden prompt-injection content in ways that removed the user from key decision points. The user might never inspect the sender, domain, checkout flow, or warning signs. The agent becomes the decision-maker, and attackers shift from deceiving the human to deceiving the browser assistant.

That shift matters for enterprise security. A compromised AI browser does not need to break into GitHub, Gmail, Google Drive, a ticketing system, or an internal portal if the user is already signed in and the agent is allowed to operate inside that session. The agent becomes a delegated actor with access inherited from the user. From a defender’s view, that looks less like classic credential theft and more like misuse of a trusted identity.

LayerX’s controlled test used a harmless plaintext file, but the attack path shows how the same technique could reach authenticated repositories, open tabs, internal tools, connected SaaS platforms, or other data sources visible to the browser session. BleepingComputer’s coverage of the research notes that LayerX’s proof of concept was tested across six mainstream agentic products, with OpenAI named as the only vendor LayerX says had a working fix at the time of publication.

The vendor response also shows how immature this control space still is. LayerX says it submitted reports between October 2025 and January 2026. Its disclosure table states that OpenAI fixed the issue in ChatGPT Atlas, Perplexity closed or ignored the Comet report, Fellou, Genspark, and Sigma did not respond, and Anthropic attempted a patch for the Claude Chrome plugin that LayerX says did not hold. Those statuses should be treated as LayerX’s reported disclosure record, not as an independently verified statement from each vendor.

Academic work on agentic prompt injection supports the same concern. A 2025 paper on prompt injection and data leakage in LLM agents found that tool-using agents can leak personal data observed during task execution, with attack success shaped by the task type, the data requested, and the agent’s role in extraction or authorization workflows. The authors also note that LLMs lack a clean mechanism for separating instructions from data, which is exactly the weakness BioShocking exploits in the browser.

The defensive answer cannot be a single prompt telling the model to be careful. BioShocking shows that the model’s interpretation layer can be manipulated before the sensitive action happens. Effective controls need to sit around the agent, the browser, and the identity plane. Sensitive reads from authenticated systems should require explicit user confirmation. Agents should treat page content, comments, hidden text, URLs, documents, and third-party data as untrusted input. High-impact actions such as reading private repositories, copying credentials, sending messages, changing settings, or posting data externally should be gated by separate policy checks rather than the model’s own judgment.

Scope control is just as important. An AI browser used to summarize a public article should not inherit access to corporate email, repositories, customer portals, admin consoles, or password managers. Agent sessions should be constrained by task, site, identity, and data class. If the user asked for help reading a page, the agent should not be able to search private GitHub repositories. If the user asked for a calendar summary, the agent should not be able to post data to an external endpoint. Least privilege has to apply to AI agents the same way it applies to service accounts.

Security teams also need visibility. Browser agents should be logged as distinct actors, not buried inside generic user activity. Defenders need to know when an agent accessed a repository, copied a secret-like string, visited an internal tool, submitted a form, read a message, or transferred content across trust boundaries. DLP, CASB, browser security, identity governance, and endpoint telemetry all become more valuable when they can distinguish normal human browsing from agent-driven action.

BioShocking is not just a clever jailbreak. It is a warning about what happens when agentic automation is placed directly on top of authenticated user sessions. The browser has become a control surface for AI, identity, SaaS access, and data movement at the same time. If attackers can influence the agent’s context, they may be able to influence what the user’s account does next.

The lesson is direct: AI browsers should not be treated as safer browsers with better assistants. They should be treated as delegated identities with browser access, SaaS reach, and automation rights. Until agentic browsing has enforceable permissions, sensitive-action confirmation, untrusted-content isolation, and full auditability, every signed-in tab becomes part of the attack surface.

FBI Seizure of NetNut Shows How Residential Proxies Turn Home Devices Into Cybercrime Infrastructure

The FBI’s seizure of domains tied to NetNut and the Popa botnet is a clear signal that residential proxy networks have moved from a gray-market privacy problem into core cybercrime infrastructure. On July 2, 2026, NetNut’s homepage was replaced with a federal seizure notice after the FBI, IRS Criminal Investigation, Google, Lumen, Shadowserver, and other partners acted against hundreds of domains associated with the service. KrebsOnSecurity reported that NetNut is operated by Alarum Technologies, a publicly traded Israeli company, and that the seizure followed research linking NetNut to Popa, a botnet estimated at no fewer than two million compromised consumer devices.

Residential proxy services sell access to real consumer IP addresses. To a target website, login portal, ad exchange, or fraud detection engine, traffic routed through one of these nodes can look like it is coming from a normal household internet connection instead of an obvious cloud server, VPN endpoint, or known criminal host. That makes residential proxies useful for legitimate testing and localization, but also valuable for credential stuffing, account takeover, scraping, ad fraud, spam, password spraying, and intrusion activity that needs to blend into normal user traffic. Google’s Threat Intelligence Group said suspected NetNut exit nodes were used by 316 distinct threat clusters in a single week during June 2026, including cybercriminal and espionage groups.

The central allegation is that NetNut’s residential pool was tied to Popa, an Android proxyware ecosystem that enrolled consumer devices into a commercial proxy network. Synthient’s research describes Popa as an Android SDK that can turn phones, tablets, and streaming boxes into residential proxy nodes. Its analysis found Popa-family samples communicating with NetNut SDK endpoints, shared infrastructure at the SDK-distribution layer, and controlled-test telemetry from June 17, 2026 showing traffic from a Popa host egressing through NetNut’s commercial gateway. Synthient also states that NetNut disputes the conclusion and says it operates a lawful proxy network with customer due diligence and abuse monitoring.

That distinction matters. A residential proxy company can claim to sell routing capacity, but the security question is how that capacity is sourced, whether device owners gave meaningful consent, and what happens once unknown third-party traffic enters a home network. Google says home devices can become exit nodes through malware preinstalled before purchase or through apps that secretly contain proxy code. Once that happens, the device owner’s IP address can be used as a launchpad for attacks, and other devices on the same local network may be exposed to internet-originated traffic routed through the compromised node.

The consumer device angle is what makes Popa so damaging. A no-name Android TV box or free streaming app is usually treated like low-risk entertainment hardware, not like a remotely controlled network relay. Yet these devices often run outdated Android builds, ship outside trusted update channels, lack transparent software provenance, and sit on the same home network as phones, laptops, routers, work devices, and smart home systems. Once proxy code is installed, the device can run constantly, relay outside traffic, and make the homeowner’s IP address part of someone else’s operation.

Google says it disabled Google accounts and services used by NetNut for malware command-and-control, shared technical intelligence on NetNut SDKs and backend infrastructure, and used Google Play Protect to warn users and disable apps known to include NetNut SDKs. Google also said the disruption reduced the pool of devices available to the proxy operator by millions. Reuters reported that Alarum confirmed it had been informed of the FBI seizure of certain domains and said it would cooperate with law enforcement.
The case also points to a much larger ecosystem. Google says NetNut was widely resold and white-labeled by third-party proxy providers, meaning customers may have been buying NetNut capacity through other brands without seeing the true upstream source. This is one reason takedowns of individual providers may produce only temporary disruption. After a network loses its own botnet capacity, it can purchase capacity from competitors and reappear as a reseller. Google linked this pattern to earlier disruption work against IPIDEA and said long-term impact requires action against several interconnected providers, not one platform at a time.

The smart TV and app ecosystem makes the problem harder to contain. Spur Intelligence scanned 6,038 LG webOS and Samsung Tizen apps and found 2,058 containing residential proxy SDKs, equal to 34.1 percent across the dataset. The reported rate was 42.5 percent for LG webOS apps and 26.9 percent for Samsung Tizen apps. That does not mean every app was tied to NetNut or Popa, but it shows that proxy SDKs are no longer limited to shady desktop utilities or mobile apps. They are being embedded into living-room software at scale.

For defenders, the main lesson is that residential IP traffic should not be trusted just due to its source category. A login attempt from a consumer ISP address can still originate from malware, proxyware, or an attacker buying access to a hijacked device. Security controls that treat residential IPs as low risk can be exploited by operators who use proxy networks to avoid datacenter blocklists, throttle limits, geography checks, and reputation scoring. Detection logic needs to account for behavioral signals, impossible travel, session anomalies, authentication velocity, ASN drift, device fingerprint changes, and repeated failed logins spread across many residential addresses.

Network teams should also look inward. Smart TVs, streaming boxes, and unmanaged Android devices should not share flat access with corporate systems, workstations, NAS devices, printers, or sensitive home-office equipment. At home, these devices belong on a guest or IoT network with client isolation where practical. In business environments, unmanaged media devices should be blocked or segmented. DNS logs, egress telemetry, and firewall records can help identify unexpected proxy protocols, persistent outbound connections, unknown relay infrastructure, SOCKS traffic, and beaconing to suspicious domains.

Consumers have fewer controls, but they are not powerless. Google recommends buying connected devices from reputable manufacturers, using official app stores, checking permissions for third-party VPN and proxy apps, and keeping Play Protect active. Google’s Android certification guidance says Play Protect certified devices must pass security and compatibility testing, ship without preinstalled malware, and include Google Play Protect protections such as app scanning.
The NetNut seizure is not just a botnet takedown. It is a reminder that the boundary between consumer electronics and attack infrastructure has eroded. A cheap streaming box, free TV app, or proxy SDK can quietly convert a household connection into a rented exit node for fraud crews, scrapers, password-spraying operators, and espionage activity. The device owner may see only a normal entertainment app. The attacker sees clean residential reach.

That is what makes residential proxy abuse so difficult to fight. It hides inside ordinary devices, ordinary networks, and ordinary IP space. The FBI and Google action against NetNut may degrade one of the largest known networks in that ecosystem, but the broader market is adaptive, reseller-heavy, and difficult to dismantle permanently. For security teams, the right response is to treat residential proxy traffic as a serious abuse vector, treat unmanaged consumer devices as potential network relays, and stop assuming that an IP address is trustworthy just because it looks like a normal home connection.

How Can Netizen Help?

Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally. 

Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.

Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.

Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.

Today’s Topics:

• Squidbleed Shows Why Old Proxy Code Still Belongs in the Threat Model
• FortiBleed Shows Why Firewall Credentials Are Now Perimeter Risk
• How can Netizen help?

Squidbleed Shows Why Old Proxy Code Still Belongs in the Threat Model

Squidbleed is the kind of vulnerability that looks small in code and much larger in an environment diagram. Tracked as CVE-2026-47729, the flaw is an out-of-bounds read in Squid’s FTP gateway that can leak fragments of proxy memory back to a client. In the worst case, that memory may contain another user’s cleartext HTTP request, including an Authorization header, bearer token, API key, session cookie, or other credential material that was never meant to leave the proxy process.

The bug is being compared to Heartbleed for a reason. This is not remote code execution. It does not give an attacker shell access, modify traffic, or knock the service offline. It reads memory past the intended boundary and returns data that should have stayed inside the process. That makes the vulnerability easier to underrate if teams focus only on exploit categories, yet memory disclosure against a shared proxy can still be a direct path to account takeover. If a leaked header contains a valid token, the attacker does not need to exploit the victim’s endpoint. They can simply reuse what the proxy exposed.

The threat model is narrow, but realistic. Squid describes the attacker as a trusted client, meaning someone already permitted to send traffic through the proxy. That matters in environments where Squid is used as a shared forward proxy for schools, enterprises, guest networks, public Wi-Fi, managed networks, or filtering gateways. The attacker does not need to be an external internet host hitting Squid from the outside. They need access as a proxy user, a Squid instance with FTP gateway functionality available, and an FTP server they control or can influence.

That limitation is also what makes the bug easy to miss during risk scoring. CVSS places it in the moderate range with network attack vector, low attack complexity, low privileges required, no user interaction, high confidentiality impact, and no integrity or availability impact. On paper, that looks contained. In practice, a shared proxy is a collection point for other people’s requests. A confidentiality-only vulnerability in that position can still expose high-value secrets.

The exposed traffic is also bounded. Standard HTTPS traffic sent through an HTTP CONNECT tunnel remains opaque to Squid, so Squidbleed does not magically decrypt the modern web. The most direct exposure is cleartext HTTP. The risk expands in deployments where Squid is configured to terminate or inspect TLS, such as SSL Bump environments, since the proxy can then see decrypted request contents before forwarding them upstream. Legacy internal applications, captive portals, old appliances, device management pages, and operational tools are the kinds of places where cleartext HTTP still tends to survive longer than security teams expect.

The root cause sits in Squid’s FTP directory-listing parser. FTP directory listings are messy, old, and inconsistent across server implementations, so Squid contains parsing logic meant to turn FTP listings into something usable for clients. The vulnerable behavior traces back to compatibility handling introduced in 1997 for NetWare-style listings, where extra whitespace could appear between a timestamp and a filename.

The parser advances a pointer after a parsed timestamp and then skips whitespace before treating the next bytes as the filename. The edge case appears when a crafted FTP listing line ends right after the timestamp and provides no filename at all. At that point, the pointer lands on the string terminator. The relevant C library behavior is the catch: strchr can match the terminating null byte in a string. If code asks whether that terminator appears inside the whitespace string, it can get a positive result. The parser then advances past the end of the intended buffer and keeps reading until it finds a byte that stops the scan.

That is where an old parser bug turns into a data exposure issue. Squid reuses memory buffers, and reused heap memory may still contain data from prior transactions. If a buffer recently held part of a different user’s HTTP request, a crafted FTP listing can overwrite only a small portion of that buffer and cause Squid to return the remaining stale bytes as if they were part of an FTP filename. The attacker sees the data in the generated FTP directory response.

Calif.io’s demonstration showed an Authorization header leaking from another client using the same proxy. That is the security impact in one line: a user who is allowed to use the proxy may be able to trigger a malformed FTP response and receive secrets from unrelated traffic handled by the same Squid process.

The fix itself is small. Squid patched the FTP gateway parsing logic by checking for the null terminator before using the character membership test that caused the over-read. The official advisory lists Squid versions older than 7.6 as affected, with Squid 4.x, 5.x, 6.x, and 7.x through 7.5 vulnerable. Squid versions older than 3.5.28 were not tested and should be treated as vulnerable. Operators using vendor-packaged builds should rely on distribution advisories and backported package fixes rather than only checking the upstream version string.

That distinction matters. Enterprise Linux distributions often backport security patches into older package versions. An environment may still show a Squid 5.x or 6.x package and be patched, or it may show a seemingly familiar package version that still lacks the fix. Ubuntu, for example, lists fixed Squid packages for supported releases such as 22.04 LTS and 24.04 LTS. Debian’s tracker shows fixed status for some releases and vulnerable status for others. The right validation step is to confirm the vendor package status or inspect whether the FtpGateway.cc guard is present.

The better mitigation, where operations allow it, is to disable FTP through Squid entirely. FTP is a legacy protocol with little place in most modern browser-driven networks. Chrome removed FTP URL support years ago, and many organizations have little legitimate need for proxy-mediated FTP access. Squid’s own advisory provides a workaround that denies FTP traffic through the proxy, with an optional allowlist for trusted FTP destinations. In many networks, the safer answer is no allowlist at all.

Blocking outbound TCP port 21 from the proxy can also reduce practical exploitability, but it should be treated as a compensating control rather than the full fix. A proxy policy change inside squid.conf is more direct, and a patched package removes the parser bug itself. Organizations should also review whether Squid is performing TLS interception, whether cleartext HTTP remains in use internally, and whether proxy users are segmented by trust level. A guest network user and a corporate endpoint should not be sharing sensitive proxy memory in the same risk bucket.

Detection is not straightforward. A successful attempt may look like FTP traffic through Squid to an attacker-controlled server, followed by abnormal directory listing responses. Security teams can review Squid access logs for unexpected ftp:// requests, outbound connections to untrusted FTP servers, and spikes of repeated FTP listing activity from a single proxy client. Network controls can flag outbound FTP from proxy infrastructure, especially in environments that do not use FTP operationally. Still, the absence of obvious logs should not be treated as proof of safety. Memory disclosure vulnerabilities rarely leave clean, high-confidence forensic markers.

The incident response question is less about wiping systems and more about credential exposure. If an organization confirms exploitability or suspicious FTP traffic through a vulnerable Squid instance, it should identify which applications and internal services still sent cleartext HTTP through that proxy. Tokens, API keys, basic authentication headers, session cookies, and service credentials exposed over HTTP should be rotated. Legacy internal applications that still rely on cleartext authentication deserve extra attention, as they are exactly the kind of systems that turn a moderate proxy bug into a real identity problem.

Squidbleed also says something broader about aging internet infrastructure. The vulnerable logic survived for nearly three decades in a mature, widely deployed open-source proxy. It sat in compatibility code for an old FTP listing format tied to platforms most modern defenders will never touch. That is not an indictment of Squid alone. It is a reminder that mature software often carries protocol support, parser logic, and compatibility branches that outlive their original use case by decades.

The AI angle is real, but it should not be exaggerated. Calif.io credited Anthropic’s Claude Mythos Preview with surfacing the strchr behavior quickly during research into Squid’s FTP state machine. That does not mean AI agents are suddenly replacing security engineering. It means they are becoming useful at finding weird interactions between old parser code, language semantics, and forgotten protocol features. For defenders, the lesson is practical: AI-assisted review may be most valuable in the code nobody wants to audit by hand anymore.

FortiBleed Shows Why Firewall Credentials Are Now Perimeter Risk

FortiBleed is not being treated as a new Fortinet zero-day, and that may be the most useful detail in the story. The campaign is larger than a single vulnerability bulletin. It is a credential problem at perimeter scale, involving internet-facing FortiGate firewalls and SSL VPN gateways where valid logins, old password hashes, weak account hygiene, and exposed management paths appear to have converged into a large verified access dataset.

CISA issued guidance after reports that malicious actors were using compromised credentials against Fortinet devices across government and private-sector networks. The public numbers vary by source and date. CISA referenced leaked credentials tied to about 74,000 Fortinet devices. SOCRadar later reported 86,644 compromised FortiGate devices, more than 80,000 unique IPs, 22,405 domains, and exposure across 194 countries. Arctic Wolf placed the confirmed range between 30,000 and 75,000 devices in its June analysis, citing differences in dataset validation and source reporting. The exact count matters less than the operating model: the actors were not guessing at a few exposed VPN portals. They were building a verified inventory of working perimeter credentials.

Fortinet has pushed back on the idea that FortiBleed is tied to a new product flaw. In its June 19 PSIRT post, the company said the activity appears to involve reused credentials from prior incidents and brute-force activity against devices with weak password hygiene and no MFA. Fortinet also said it was not related to any current incident or advisory. That distinction is technically meaningful. It also should not make defenders comfortable. A valid firewall login obtained through credential reuse can be just as operationally useful as access gained through an exploit chain.

The risk starts with what FortiGate devices are. These appliances often sit at the boundary between the public internet and internal networks. They terminate VPN access, enforce firewall policy, route traffic, hold certificates, connect to identity providers, and often integrate with Active Directory, LDAP, RADIUS, TACACS+, SAML, or other authentication systems. Administrative access to that control plane gives an attacker far more than a login screen. It can provide network topology, user access paths, VPN visibility, configuration data, and a starting point for lateral movement.

SOCRadar described FortiBleed as an automated operation built in two stages. The first stage tests curated username and password combinations against internet-facing Fortinet endpoints. The second stage reportedly uses successful access to collect more credentials from traffic passing through the device, feeding those credentials back into the same access operation. Dutch NCSC also warned that researchers had seen attackers collect packet captures from Fortinet systems in several cases, creating the possibility that more authentication material was exposed after initial firewall access.

That is what makes this different from a normal credential stuffing story. The firewall is not just the target. Once compromised, it can become a collection point. A compromised SSL VPN or firewall appliance may expose user names, VPN sessions, internal addressing, authentication integrations, service accounts, and administrative behavior. If the appliance is tied into directory services, the downstream risk moves into identity infrastructure. Fortinet’s own guidance says that if AD or LDAP integration is configured, that account should be treated as compromised and monitored for use elsewhere.

The older credential storage behavior adds another layer. Fortinet’s technical guidance says FortiOS 7.2.11, 7.4.8, and 7.6.1 introduced PBKDF2 for administrator password storage, replacing SHA-256-based storage. The migration is conditional. After an upgrade from an older version, administrator passwords can remain stored as SHA-256 hashes until the corresponding administrator logs in after the upgrade. Fortinet also notes that older SHA-256 values may remain in a hidden old-password setting for backward compatibility, visible in configuration backups taken by a super admin account.

That matters for two reasons. First, SHA-256 is fast. Fast hashing is bad for password storage when an attacker can obtain hashes and work offline with GPU cracking rigs. Second, many organizations treat firmware upgrades as complete once the version number changes. In this case, the version number alone may not remove the weaker stored credential material. Admin logins, password resets, and Fortinet’s weaker-encryption lockout setting may still be needed to move accounts away from legacy hash exposure.

This is why “patch and move on” is too narrow here. Updating FortiOS is part of the response, but FortiBleed is about credential state, session state, configuration state, and exposure state. A firewall can be on a newer train and still carry old credential baggage. A password can be complex and still be compromised if it was reused, leaked, harvested from an earlier incident, or cracked from a stored hash. An admin interface can be patched and still risky if it remains reachable from the public internet.

The account patterns reported by SOCRadar point to basic but damaging failures. Generic admin accounts and Fortinet system-style accounts accounted for a large share of the exposed credentials. Organization-specific accounts also made up a significant portion of the dataset, which suggests the campaign reached beyond factory naming conventions and default behavior. This is a familiar perimeter problem: predictable account names reduce attacker cost, password reuse extends breach life, and exposed management interfaces let attackers test access at internet scale.

For attackers, a valid FortiGate credential can be more valuable than a workstation foothold. It may allow rule changes, VPN account creation, configuration export, traffic capture, route manipulation, certificate inspection, logging changes, and stealthy access maintenance. A firewall is also a trust anchor in many environments. Security tools often assume it is enforcing policy correctly. If an attacker controls or modifies that enforcement point, detections inside the network may see only the later stages of an intrusion.

That is the defensive lesson. FortiBleed should be treated as an identity incident and a perimeter device incident at the same time. Ending active SSL VPN and administrative sessions is the containment step that breaks live access. Password resets address known and unknown credential exposure. MFA limits replay. PBKDF2 migration reduces the value of stolen configuration hashes. Management access restrictions reduce the number of systems attackers can test. Log review determines whether the appliance was just exposed or actually used as a pivot.

The log review should be wide. Firewall and VPN logs can show unexpected administrator access, unfamiliar source IPs, strange login times, failed sprays, successful logins after long dormancy, new local users, password resets, policy changes, route changes, certificate changes, and configuration exports. Domain controller and identity logs can show lateral movement after the perimeter event, such as unusual use of LDAP bind accounts, new privileged accounts, VPN users authenticating from rare geographies, or service accounts appearing outside their normal pattern. Configuration comparison against a known-good backup can catch subtle persistence that normal event review may miss.

The response also needs to cover more than human administrator passwords. Local Fortinet administrators, VPN users, API accounts, service accounts, LDAP and RADIUS bind accounts, TACACS+ secrets, SAML-related credentials, shared accounts, and any reused credentials on adjacent edge devices should be rotated where exposure is plausible. If packet capture or traffic inspection occurred, downstream application credentials may also need review. Treating this as a single admin password reset can leave the real blast radius untouched.

Management exposure is another core issue. Fortinet recommends trusted hosts as a baseline, local-in policy as a stronger control, and removal of internet administration as the preferred end state. That hierarchy is correct. Internet-facing firewall administration creates a public test surface for credential abuse. Even with MFA, every exposed login endpoint becomes an opportunity for enumeration, spraying, social engineering follow-up, and future vulnerability exploitation. Admin access should be reachable through controlled management networks, jump hosts, VPN paths with strong MFA, and explicit source restrictions.

This incident also fits a broader pattern. Perimeter appliances have become high-value identity targets, not just vulnerability targets. Attackers do not always need a new exploit if they can reuse credentials from an old one. They do not need malware on an endpoint if a firewall hands them remote access. They do not need to decrypt the whole network if the gateway already sees enough traffic to collect the next set of secrets. FortiBleed shows how yesterday’s breach data, today’s exposed management interface, and legacy password storage can combine into a current intrusion path.

The name makes the campaign sound like a single wound. The real problem is more structural. Many organizations still operate perimeter devices as static infrastructure, patched on a schedule and checked during audits, rather than as identity-bearing systems that need continuous credential rotation, configuration drift review, management-plane isolation, and telemetry. A firewall is not just a box that filters traffic. It is a privileged identity system with routes, secrets, sessions, and trust relationships attached to it.

For Fortinet customers, the near-term answer is clear: terminate sessions, rotate credentials, confirm MFA, upgrade to supported FortiOS branches, force PBKDF2 migration, remove legacy hashes, review logs, compare configurations, and restrict management access. For any environment with signs of unauthorized configuration changes, unexpected accounts, suspicious VPN activity, or packet capture use, treat the appliance as compromised and investigate internal movement from that point forward.

How Can Netizen Help?

Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally. 

Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.

Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.

Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.

Today’s Topics:

• INTERPOL Warns Cybercrime Is Surging Across Asia-Pacific as Phishing, Ransomware, and AI Scams Scale Up
• The Gentlemen Ransomware Shows How Former Affiliates Are Building Faster, Leaner RaaS Operations
• How can Netizen help?

INTERPOL Warns Cybercrime Is Surging Across Asia-Pacific as Phishing, Ransomware, and AI Scams Scale Up

Cybercrime is rising sharply across Asia and the South Pacific, with phishing, ransomware, banking malware, information stealers, deepfakes, and AI-assisted fraud placing new pressure on governments, businesses, and law enforcement agencies across the region. A new INTERPOL assessment says the threat environment has been shaped by fast digital adoption, wider internet access, organized criminal networks, uneven cybersecurity maturity, and the growing use of artificial intelligence in online crime.

According to INTERPOL’s 2025/2026 Asia and South Pacific Cyberthreat Assessment Report, phishing is now the most widespread and financially damaging form of cybercrime reported across the region. A third of countries covered in the assessment recorded more than 10,000 phishing cases between January 2024 and March 2025. More than half of INTERPOL member countries also reported that cybercrime made up at least 30% of all nationally recorded crime.

The numbers point to a broader shift in how cybercrime is operating. Phishing is no longer limited to low-effort credential theft emails or generic lures. Criminal groups are combining social engineering, fake login pages, malware delivery, business impersonation, and AI-generated content to reach more victims at scale. In many cases, phishing now serves as the entry point for broader fraud, account takeover, ransomware deployment, or data theft.

Ransomware also remains a major threat across the Asia-Pacific region. INTERPOL estimated that more than 135,000 ransomware-related attacks affected the region in 2024, with real estate, manufacturing, and financial services among the most heavily impacted sectors. These industries are attractive targets due to their operational reliance on digital systems, high-value data, financial exposure, and limited tolerance for downtime.

Ransomware groups are also increasing pressure during extortion by using victims’ regulatory and legal obligations against them. Rather than relying only on encryption, attackers may steal data, threaten public leaks, contact customers, reference compliance requirements, or use breach disclosure timelines to force faster payment decisions. This makes ransomware a legal, financial, operational, and reputational crisis, not just a technical incident.

INTERPOL also warned that AI-enabled scams are becoming more common, especially in impersonation and fraud campaigns. Deepfake audio, synthetic video, AI-generated personas, and more convincing written messages are being used to impersonate executives, manipulate victims, authorize fraudulent transfers, and support romance or investment scams. These tools reduce the skill required to produce believable social engineering content and allow criminal groups to run higher-volume campaigns with more convincing narratives.

The report also points to the industrialization of cyber-enabled fraud by transnational organized crime groups. Scam centers in Cambodia, Laos, Myanmar, and the Philippines have been linked to large-scale fraud operations that use forced labor to conduct investment scams, romance baiting schemes, and other online fraud. INTERPOL said organized crime groups in Myanmar, Cambodia, and Laos have used deepfakes in romance baiting scams, combining AI personas with social engineering in schemes tied to billions of dollars in regional cybercrime losses.

Malware activity is also expanding. Banking trojans and information stealers ranked as the second most common category of cybercrime in the report, with families such as RedLine, Lumma, LokiBot, Negasteal, and ZBot appearing among the most active threats. These tools are often used to harvest browser-stored credentials, session cookies, cryptocurrency wallet data, system information, and authentication material that can later be sold, reused, or combined with other intrusion activity.

Phishing link engagement in the region also exceeded the global average. INTERPOL reported that 5.5 out of every 1,000 individuals in Asia and the South Pacific clicked phishing links monthly, compared with a global average of 2.9 per 1,000. That higher rate gives attackers more opportunities to harvest credentials, compromise accounts, deliver malware, and move into business email compromise or identity fraud.

Distributed denial-of-service attacks also increased sharply, rising 92% in 2024 compared with the prior year. These attacks can be used to disrupt public services, pressure businesses, distract defenders, or support extortion campaigns. For organizations with weak network resilience or limited incident response capability, DDoS activity can create service outages that damage operations and public trust.

System intrusions remain a major driver of data breaches, accounting for about 80% of all data breach activity in 2024, according to the report. INTERPOL cited misconfigured systems, weak encryption, insecure APIs, and insufficient monitoring as common weaknesses attackers exploit to gain access to target networks. These issues are familiar to defenders, but their impact grows as organizations move more services online and expose more cloud, application, and identity infrastructure to the internet.

The rise in deepfake abuse has also created new risks beyond financial fraud. INTERPOL warned that synthetic media is being used for sexual exploitation, blackmail, and coercion. That threat category shows how AI-enabled cybercrime can cross from enterprise risk into personal harm, placing pressure on law enforcement agencies to respond to both technical abuse and human exploitation.

The regional trend is clear: cybercrime across Asia and the South Pacific is becoming more organized, more automated, and more closely tied to traditional criminal enterprises. Phishing, ransomware, infostealers, deepfakes, and online scams are no longer separate threat categories. They increasingly operate as connected parts of a broader criminal economy, where stolen credentials, synthetic identities, malware access, extortion, and fraud infrastructure support one another.

INTERPOL said law enforcement organizations across the region are scaling joint efforts to disrupt cybercriminal infrastructure, coordinate investigations, share intelligence, train personnel, and strengthen cyber resilience policies. That cooperation will be necessary as criminal groups continue using AI, ransomware-as-a-service, social engineering, and cross-border infrastructure to target victims at scale.

For organizations, the report reinforces the need to treat phishing resistance, ransomware readiness, identity security, endpoint visibility, API hardening, monitoring, incident response planning, and employee training as connected defensive priorities. The threat is no longer limited to isolated scams or opportunistic malware. It is a regional cybercrime ecosystem built to exploit weak controls, human trust, exposed systems, and the growing use of AI in both business and crime.

The Gentlemen Ransomware Shows How Former Affiliates Are Building Faster, Leaner RaaS Operations

The Gentlemen ransomware operation is a case study in how the ransomware-as-a-service economy is changing. The group did not appear as a fully isolated criminal brand with no prior tradecraft behind it. Reporting from PRODAFT, Microsoft, Check Point Research, Huntress, Trend Micro, and other threat intelligence teams indicates that The Gentlemen grew out of earlier affiliate activity tied to established ransomware ecosystems, then moved into its own independent partnership program after disputes, leaks, and instability inside the underground market.

PRODAFT tracks the group as Phantom Mantis and says it was initially known as ArmCorp. The operation has been active since March 2025 and is assessed to be led by a Russian-speaking threat actor tracked as LARVA-368, associated with aliases including hastalamuerte, ArmCorp, zeta88, nobody0, and santamuerte. Before launching The Gentlemen as a standalone program, the actor is said to have worked with or borrowed from ransomware ecosystems linked to LockBit, Qilin, Medusa, and Embargo. That background matters, since The Gentlemen does not look like a novice operation. It looks like a group built by people who already knew how ransomware crews recruit affiliates, manage panels, negotiate payments, move data, and pressure victims.

The operation’s shift from ArmCorp into The Gentlemen appears to have accelerated in July 2025 after a dispute with Qilin, with LARVA-368 alleging that roughly $48,000 in affiliate commissions had been withheld. That dispute fits a larger pattern in the ransomware market. Since 2023, major crews have been disrupted, exposed, rebranded, or accused of cheating affiliates. LockBit was hit by law enforcement action, ALPHV collapsed after payment controversy, RansomHub disappeared from public view, and several smaller crews splintered into private or semi-private programs. In that climate, experienced affiliates have more incentive to build their own platforms rather than depend on larger brands that may steal commissions, lose infrastructure, or attract too much law enforcement pressure.

The Gentlemen’s growth has been tied closely to that affiliate-first model. Check Point Research reported that the group publicly claimed more than 320 victims by April 2026, with 240 of those claims occurring in the first months of 2026. Halcyon has assessed that the group offered affiliates a 90/10 revenue split, giving affiliates 90 percent of ransom proceeds. That is higher than the 70/30 or 80/20 split common across many RaaS programs, making it a strong recruitment tool for operators who already have access, tradecraft, and victim pipelines.

This is one reason The Gentlemen should be seen as a business-model threat, not just a malware threat. The ransomware itself is dangerous, but the affiliate structure is what allows the operation to scale. Operators provide the locker, infrastructure, support, leak site, and build process. Affiliates bring access, execute intrusions, steal data, deploy ransomware, and negotiate with victims through their own Tox or messaging identifiers. That separation lets the core program support many intrusions without directly conducting each one.

The group’s internal communications, later exposed through leaks affecting its Rocket.Chat environment, gave researchers an unusually clear view into how the operation functioned. PRODAFT said it identified 34 registered users in the group’s Rocket.Chat instance between May 2025 and April 2026. Check Point Research reported that leaked material included conversations about initial access, edge appliance exploitation, affiliate roles, shared tools, backend systems, victim handling, and ransom negotiations. The leak also exposed accounts connected to the administrator, who reportedly managed infrastructure, built lockers, handled the RaaS panel, and oversaw payouts.

The internal structure shows a division of labor that resembles a criminal services platform. One role, referred to as The Gentlemen Data, appears focused on data exfiltration support, helping move stolen information from affiliate-controlled cloud storage into The Gentlemen infrastructure for publication on the group’s leak site. LARVA-368 and related support channels appear to have helped affiliates with encryption, intrusion troubleshooting, and security-tool bypasses. Support moved through Tox, SimpleX Chat, Ricochet Refresh, and other messaging platforms after the Rocket.Chat leaks damaged the group’s internal trust.

The affiliate panel also reflects the maturity of the operation. PRODAFT reported that prospective affiliates needed to provide at least 1 GB of exfiltrated victim data before gaining access to the panel, a vetting method also seen in other ransomware crews trying to keep researchers and law enforcement out. The panel reportedly allowed affiliates to configure targets, build ransomware packages, download lockers, manage users, and track victim states. That kind of infrastructure lowers friction for affiliates and helps standardize attacks across different operators.

The ransomware payload is built for broad enterprise coverage. Reporting indicates that The Gentlemen supports Windows, Linux, ESXi, older Windows systems, and LVM environments. Microsoft tracks the operators as Storm-2697 and described the Windows encryptor as a Go-based ransomware family obfuscated with Garble. Microsoft also reported that the ransomware can use self-propagation logic, turning a single-host encryptor into malware that attempts to spread across reachable systems once enabled by the operator. That feature raises the risk of domain-wide impact after initial access, particularly in flat networks with weak segmentation and overprivileged accounts.

The ransomware’s options show a focus on speed, reach, and recovery disruption. Analysts have reported features for local encryption, network share encryption, delayed execution, selective scope, self-deletion, free-space wiping, GPO-based deployment, and propagation using credential material. ESXi support gives the group a path to affect virtualization infrastructure, where encrypting hosts or datastores can impact many workloads at once. LVM support extends the reach against Linux storage configurations and block-device targets. This cross-platform coverage reflects how modern ransomware crews build for mixed enterprise environments rather than single endpoint classes.

Incident reporting from Huntress and Trend Micro also shows that affiliates deploying The Gentlemen have used common enterprise intrusion tradecraft before encryption. Observed activity has included scheduled task abuse, Windows scripting, log clearing, Defender tampering, antivirus exclusions, remote access tooling such as AnyDesk, Group Policy manipulation, privileged account compromise, encrypted file transfer, and legitimate driver abuse. These techniques are not new on their own. The risk comes from how they are packaged into a repeatable affiliate workflow backed by a growing RaaS program.

Initial access patterns also match broader ransomware trends. Researchers have pointed to exposed edge devices, VPN appliances, firewall infrastructure, stolen credentials, and public-facing services as common entry paths. Check Point’s analysis of an affiliate-linked incident involving SystemBC found more than 1,570 victims connected to the relevant command-and-control server, with signs that many were corporate or organizational environments. SystemBC is often used in human-operated ransomware intrusions to create proxy access, support tunneling, and enable later payload delivery.

The Gentlemen’s use of AI, as described by PRODAFT, adds another layer to the story. LARVA-368 reportedly used AI to assist with ransomware and tool development, maintenance, and post-exploitation procedures. That does not mean AI created the operation by itself. The more realistic concern is that AI can reduce development time, help operators troubleshoot code, generate scripts, translate instructions, maintain panels, and produce procedural guidance for affiliates. For groups already familiar with ransomware operations, AI can act as a force multiplier across coding, documentation, support, and attack planning.

How Can Netizen Help?

Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally. 

Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.

Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.

Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.