[{"data":1,"prerenderedAt":809},["ShallowReactive",2],{"post-en-der-grosste-angriff-auf-die-npm-lieferkette":3,"related-en-der-grosste-angriff-auf-die-npm-lieferkette":388},{"id":4,"title":5,"author":6,"body":7,"category":359,"date":360,"description":361,"draft":362,"extension":363,"faq":364,"image":374,"imageAlt":375,"lang":376,"legacyUrl":375,"meta":377,"navigation":378,"path":379,"readingTime":380,"seo":381,"sitemap":382,"stem":383,"tags":384,"translation":386,"updated":375,"__hash__":387},"insightsEn\u002Fen\u002Finsights\u002Fder-grosste-angriff-auf-die-npm-lieferkette.md","The Biggest Attack on the npm Supply Chain","blacklens.io Team",{"type":8,"value":9,"toc":349},"minimark",[10,15,57,61,68,73,76,82,85,91,94,189,203,207,246,250,273,277,284,320,324,343],[11,12,14],"h3",{"id":13},"introduction-the-biggest-npm-supply-chain-attack-in-history","Introduction: the biggest npm supply chain attack in history",[16,17,18,19,23,24,27,28,32,33,36,37,40,41,48,49,52,53,56],"p",{},"In September 2025, a supply chain attack shook the open-source world: ",[20,21,22],"strong",{},"18 widely used npm packages"," – together more than ",[20,25,26],{},"2 billion downloads per week"," – were compromised with malicious code. A maintainer (username ",[29,30,31],"em",{},"\"qix\"",") fell for a phishing email, giving attackers access to the npm account and allowing them to publish new, manipulated package versions. The malware ",[20,34,35],{},"specifically targeted crypto transactions",": it embedded itself in the browser, monitored Web3 activity, manipulated wallet interactions and silently changed destination addresses to redirect transactions to attacker-controlled wallets. Fortunately, the attack was ",[20,38,39],{},"detected and contained quickly",", so the immediate financial damage remained small – according to reports, the attackers made off with only a few cents in cryptocurrency. But experts warn that a similar incident with a more aggressive payload (such as espionage or ransomware) would have far more devastating consequences for thousands of companies",[42,43,47],"a",{"href":44,"rel":45},"https:\u002F\u002Fkrebsonsecurity.com\u002F2025\u002F09\u002F18-popular-code-packages-hacked-rigged-to-steal-crypto\u002F#:~:text=software%20today%2C%20after%20a%20developer,difficult%20to%20detect%20and%20restrain",[46],"nofollow","KrebsOnSecurity",". ",[20,50,51],{},"Software supply chain attacks"," like this one are increasing rapidly: Gartner predicts that by 2025, ",[20,54,55],{},"45% of organisations worldwide"," will have experienced such an attack (three times as many as in 2021). For IT security decision-makers, this is a wake-up call to urgently scrutinise the risks in their own software supply chain.",[11,58,60],{"id":59},"how-to-check-whether-your-company-is-affected","How to check whether your company is affected",[16,62,63,64,67],{},"Companies using npm packages should ",[20,65,66],{},"check immediately"," whether compromised versions have been included.",[69,70,72],"h5",{"id":71},"search-your-codebase","Search your codebase",[16,74,75],{},"The following command lets you search JavaScript files specifically for the malicious code artefacts (_0x112fa8):",[16,77,78],{},[79,80,81],"code",{},"rg -uu --max-columns=80 --glob '*.js' _0x112fa8",[16,83,84],{},"If there are any hits, extreme caution is required – the affected components should be removed or updated immediately.",[69,86,88],{"id":87},"specifically-affected-package-versions",[20,89,90],{},"Specifically affected package versions",[16,92,93],{},"As things currently stand, the following packages are compromised:",[95,96,97,103,109,114,119,124,129,134,139,144,149,154,159,164,169,174,179,184],"ul",{},[98,99,100],"li",{},[79,101,102],{},"ansi-styles@6.2.2",[98,104,105,108],{},[79,106,107],{},"debug@4.4.2"," (already unpublished as of 8 Sep, 18:09 CEST)",[98,110,111],{},[79,112,113],{},"chalk@5.6.1",[98,115,116],{},[79,117,118],{},"supports-color@10.2.1",[98,120,121],{},[79,122,123],{},"strip-ansi@7.1.1",[98,125,126],{},[79,127,128],{},"ansi-regex@6.2.1",[98,130,131],{},[79,132,133],{},"wrap-ansi@9.0.1",[98,135,136],{},[79,137,138],{},"color-convert@3.1.1",[98,140,141],{},[79,142,143],{},"color-name@2.0.1",[98,145,146],{},[79,147,148],{},"is-arrayish@0.3.3",[98,150,151],{},[79,152,153],{},"slice-ansi@7.1.1",[98,155,156],{},[79,157,158],{},"color@5.0.1",[98,160,161],{},[79,162,163],{},"color-string@2.1.1",[98,165,166],{},[79,167,168],{},"simple-swizzle@0.2.3",[98,170,171],{},[79,172,173],{},"supports-hyperlinks@4.1.1",[98,175,176],{},[79,177,178],{},"has-ansi@6.0.1",[98,180,181],{},[79,182,183],{},"chalk-template@1.1.1",[98,185,186],{},[79,187,188],{},"backslash@0.2.1",[16,190,191,194,195,198,199,202],{},[20,192,193],{},"Recommendation:"," Check your dependencies (e.g. with ",[79,196,197],{},"npm ls"," or ",[79,200,201],{},"yarn list",") and update compromised packages to safe versions immediately.",[11,204,206],{"id":205},"challenges-for-companies-and-cisos","Challenges for companies and CISOs",[16,208,209,210,213,214,217,218,48,221,224,225,48,230,233,234,237,238,241,242,245],{},"For ",[20,211,212],{},"CISOs, CIOs and IT leaders",", this incident highlights the considerable challenges of managing open-source dependencies. Modern applications are built on countless external libraries – even ",[20,215,216],{},"trusted modules can become a threat overnight",". The crux: you not only have to trust your direct software suppliers but also all of their suppliers. A single compromised package can potentially infect ",[20,219,220],{},"hundreds of applications across a wide range of companies",[20,222,223],{},"Detecting such attacks"," is difficult because the malicious code is often cleverly obfuscated and conventional security measures do not immediately recognise it as a threat. In this npm case, the malware only acted under specific conditions (in the browser during crypto transactions), which initially left it unnoticed in many environments",[42,226,229],{"href":227,"rel":228},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack\u002F#:~:text=The%20malicious%20code%20only%20impacts,sent%20to%20the%20intended%20address",[46],"BleepingComputer",[20,231,232],{},"Response time"," is critical: only a short time passed between the publication of the manipulated versions and their discovery – but every company that deployed or built within that window subsequently had to clean up its systems at considerable expense. While the direct financial damage remained minimal, the ",[20,235,236],{},"follow-on costs"," were substantial: teams worldwide invested thousands of hours in incident response and remediation, and the incident will trigger numerous new security investments. This effort and the potential reputational damage ultimately hit the companies themselves. The challenge, then, is to manage such risks ",[20,239,240],{},"preventively"," and to be ",[20,243,244],{},"informed immediately"," in the event of an incident in order to limit the damage.",[11,247,249],{"id":248},"how-blacklensio-helps","How blacklens.io helps",[16,251,252,253,256,257,260,261,264,265,268,269,272],{},"This is where ",[20,254,255],{},"blacklens.io"," comes in as a comprehensive cyber security platform that proactively arms companies against supply chain threats of this kind. blacklens.io offers ",[20,258,259],{},"holistic attack surface management",", meaning that all external IT assets and their vulnerabilities are continuously recorded and monitored. This also includes ",[20,262,263],{},"monitoring the technologies and components in use"," – if, for example, one of your web assets suddenly depends on a known vulnerable or compromised library, this can be detected early. In particular, the ",[29,266,267],{},"Emerging Threat Scanning & Notifications"," feature warns you of ",[20,270,271],{},"new threats in real time",". If your company were affected by the npm attack, blacklens.io would inform you immediately about the compromised packages and provide recommendations for action.",[11,274,276],{"id":275},"concrete-benefits-for-cisos-cios-and-co","Concrete benefits for CISOs, CIOs and co.",[16,278,279,280,283],{},"A ",[20,281,282],{},"proactive security approach"," using platforms such as blacklens.io offers IT leadership tangible advantages:",[95,285,286,292,298,304,314],{},[98,287,288,291],{},[20,289,290],{},"Early warning system for new threats:"," You learn immediately about critical incidents such as the npm supply chain attack and can initiate countermeasures right away, before wider publicity causes damage.",[98,293,294,297],{},[20,295,296],{},"Transparency across your attack surface:"," Continuous attack surface management means you know exactly which assets and third-party components you are using. This enables a quick assessment of whether your company is affected by the failure or compromise of a particular library.",[98,299,300,303],{},[20,301,302],{},"Reduced risk of compromise:"," Automated vulnerability and leak scans allow many attack paths – whether via outdated software, misconfigurations or leaked credentials – to be closed in advance. This makes it harder for attackers to get in, even if a gap opens somewhere in the supply chain.",[98,305,306,309,310,313],{},[20,307,308],{},"Efficient incident response:"," Should an incident occur nonetheless, blacklens.io delivers context-rich information (e.g. affected assets, indicators of compromise) at a glance. This ",[20,311,312],{},"saves valuable time"," in root cause analysis and containment.",[98,315,316,319],{},[20,317,318],{},"Building trust and compliance:"," By demonstrating that you have your supply chain risks under control, you strengthen the trust of customers and partners. Many industry standards and regulators now require supply chain risk management – blacklens.io supports you with the necessary evidence and reports.",[11,321,323],{"id":322},"conclusion-and-outlook","Conclusion and outlook",[16,325,326,327,330,331,334,335,338,339,342],{},"The recent npm supply chain attack is a stark reminder that ",[20,328,329],{},"even widely used open-source components can abruptly turn into a threat",". For companies this means: ",[20,332,333],{},"prevention over cure",". CISOs and IT leaders should draw the lessons now – from more rigorous vetting and securing of software suppliers to introducing solutions for continuous attack surface monitoring. Investing in proactive security platforms such as blacklens.io pays off by detecting and mitigating risks early. Given the forecast of rapidly increasing supply chain attacks, it is crucial to set the course today. ",[20,336,337],{},"Act now"," to protect your organisation from the next wave of supply chain attacks – before attackers find the weaknesses in your trusted connections. Do not trust blindly; instead, use the right tools to gain the necessary ",[20,340,341],{},"transparency and control"," over your entire digital supply chain.",[16,344,345,348],{},[20,346,347],{},"Further information:"," If you would like to learn more about how blacklens.io can strengthen your security strategy, we are happy to advise you. Learn how a comprehensive attack surface management platform helps to detect incidents like the npm attack in time and respond to them effectively. Because one thing is certain: in today's threat landscape, those who are prepared win.",{"title":350,"searchDepth":351,"depth":351,"links":352},"",3,[353,354,355,356,357,358],{"id":13,"depth":351,"text":14},{"id":59,"depth":351,"text":60},{"id":205,"depth":351,"text":206},{"id":248,"depth":351,"text":249},{"id":275,"depth":351,"text":276},{"id":322,"depth":351,"text":323},"threat","2025-09-17","The biggest supply chain attack in npm's history compromised packages with over 2 billion weekly downloads. Which packages were affected and how to check.",false,"md",[365,368,371],{"q":366,"a":367},"What happened in the September 2025 npm supply chain attack?","A maintainer known as qix fell for a phishing email, giving attackers control of their npm account. The attackers published manipulated versions of 18 widely used packages, including chalk, debug and ansi-styles, with a combined 2 billion weekly downloads; the malware hijacked crypto transactions in the browser by silently swapping wallet addresses.",{"q":369,"a":370},"How can I check whether my project uses the compromised npm packages?","Search your codebase for the malicious artefact _0x112fa8 in JavaScript files, for example with rg -uu --glob '*.js' _0x112fa8, and review your dependency tree with npm ls or yarn list. Compare the results against the list of affected versions such as chalk@5.6.1, debug@4.4.2 and ansi-styles@6.2.2 and update any matches to safe versions immediately.",{"q":372,"a":373},"How does blacklens.io help protect against software supply chain attacks?","blacklens.io continuously records and monitors external IT assets and the technologies and components they depend on as part of its attack surface management. Emerging Threat Scanning & Notifications warns of new threats such as compromised libraries in real time and provides context like affected assets and indicators of compromise to speed up the response.","\u002Fimages\u002Finsights\u002F68bfc25b3699909262f63a49_npm_supply_chain.jpg",null,"en",{},true,"\u002Fen\u002Finsights\u002Fder-grosste-angriff-auf-die-npm-lieferkette",5,{"title":5,"description":361},{"loc":379},"en\u002Finsights\u002Fder-grosste-angriff-auf-die-npm-lieferkette",[385],"Threat landscape","der-grosste-angriff-auf-die-npm-lieferkette","NAETBe621hM58FAKCeGwaWh_QB-_GuOzV81fHI4Xmlw",[389,648,722],{"id":390,"title":391,"author":6,"body":392,"category":623,"date":624,"description":625,"draft":362,"extension":363,"faq":626,"image":636,"imageAlt":375,"lang":376,"legacyUrl":375,"meta":637,"navigation":378,"path":638,"readingTime":380,"seo":639,"sitemap":640,"stem":643,"tags":644,"translation":646,"updated":375,"__hash__":647},"insightsEn\u002Fen\u002Finsights\u002Fwas-zuerst-intelligente-schwachstellen-priorisierung-mit-blacklens.md","What First? Intelligent Vulnerability Prioritisation with blacklens",{"type":8,"value":393,"toc":614},[394,399,406,412,417,424,454,457,461,464,508,511,517,521,528,547,551,557,581,585,596,600,603],[395,396,398],"h1",{"id":397},"what-first-intelligent-vulnerability-prioritisation-with-blacklens","What first? Intelligent vulnerability prioritisation with blacklens",[16,400,401,402,405],{},"The uncomfortable truth in vulnerability management: the problem is rarely ",[29,403,404],{},"finding"," vulnerabilities. The problem is spotting, among a thousand findings, the ten that really matter today. Anyone who works through the list by raw CVSS score burns time on findings that will never be exploited – while the one genuinely reachable, genuinely exploitable flaw waits in row 847 of the spreadsheet.",[16,407,408,409],{},"With its latest release, blacklens answers the three questions on which prioritisation really hinges: ",[20,410,411],{},"What first? Why that one? And how do we fix it?",[413,414,416],"h2",{"id":415},"a-plan-instead-of-a-spreadsheet-the-remediation-plan","A plan instead of a spreadsheet: the Remediation Plan",[16,418,419,420,423],{},"Under ",[20,421,422],{},"Vulnerabilities → Remediation",", blacklens generates a prioritised action plan from all open findings at the push of a button – external, internal and cloud considered together:",[95,425,426,432,438,444],{},[98,427,428,431],{},[20,429,430],{},"Grouped by the fix, not by the finding."," An outdated TLS setup on twelve hosts is not a dozen tasks but one. The plan bundles findings by the measure that fixes them together.",[98,433,434,437],{},[20,435,436],{},"Sorted by risk reduction."," At the top sits the cluster with the greatest leverage – by severity and breadth. Not the loudest one, the most effective one.",[98,439,440,443],{},[20,441,442],{},"With rationale and instructions."," Each cluster explains why it sits where it does, estimates the effort (low \u002F medium \u002F high) and provides numbered steps, including copy-ready code where appropriate.",[98,445,446,449,450,453],{},[20,447,448],{},"Progress you can see."," While your team works, the plan stays stable – only the counters move: completed steps, resolved instances, coverage of open findings. Right up to ",[29,451,452],{},"\"Plan complete — nice work\"",".",[16,455,456],{},"Generation takes around 30–60 seconds, and you can keep working in the meantime. The result changes your team's unit of work: no longer \"finding by finding\" but \"step by step\" – with visible movement instead of an endless backlog.",[413,458,460],{"id":459},"prioritising-means-understanding-context-on-every-finding","Prioritising means understanding: context on every finding",[16,462,463],{},"A good order needs good reasons. That is why every finding – external, internal and cloud – gets an explanation layer that makes prioritisation decisions robust:",[95,465,466,486,492,502],{},[98,467,468,471,472,475,476,475,479,198,482,485],{},[20,469,470],{},"Urgency with evidence:"," A suggested rating along with an exploit status chip – ",[29,473,474],{},"Exploit available",", ",[29,477,478],{},"PoC public",[29,480,481],{},"No known exploit",[29,483,484],{},"Exploitability unknown",". The platform severity remains authoritative; the assessment supplements it, it does not override it.",[98,487,488,491],{},[20,489,490],{},"Threat intelligence per CVE:"," CVSS, EPSS (probability of exploitation in the wild within 30 days), exploit\u002FPoC availability, attack vector and advisory link – from the blacklens threat feed. Exactly the data you need to tell \"high\" from \"urgent\".",[98,493,494,497,498,501],{},[20,495,496],{},"Root cause, impact and remediation:"," Why the finding exists, what it exposes and how it is closed – in 1–6 concrete steps. Plus ",[20,499,500],{},"compensating controls"," for the realistic case that the actual fix has to wait.",[98,503,504,507],{},[20,505,506],{},"Follow-up questions right on the finding:"," A chat beneath the analysis answers follow-up questions in the real context of your workspace – the actual service fingerprint, the affected hosts, the same finding on other systems.",[16,509,510],{},"The analyses are generated on request, cached transparently with a timestamp and visibly carry a note to review generated content before taking critical steps. The decision stays with your team – it just gets considerably faster.",[16,512,513],{},[514,515],"img",{"alt":350,"src":516},"\u002Fimages\u002Finsights\u002F6a8eab8037efc3396911b5c6_Screenshot-2026-08-26-at-10.59.14.png",[413,518,520],{"id":519},"prioritisation-beyond-the-cve-which-lookalike-domain-is-dangerous","Prioritisation beyond the CVE: which lookalike domain is dangerous?",[16,522,523,524,527],{},"With typosquatting, too, the question is never \"are there lookalikes?\" but \"which of them is a problem?\". The new detail view provides the basis for that decision: a character diff against your domain, registration and DNS data, a reputation score – and risk badges such as ",[29,525,526],{},"Mail capable"," that show at a glance whether a domain has everything credential phishing needs.",[16,529,530,531,534,535,538,539,542,543,546],{},"On demand, blacklens goes one step further: it captures what the domain actually serves, including a screenshot, and assesses whether it imitates your brand. ",[20,532,533],{},"Evidence and assessment stay cleanly separated",": ",[29,536,537],{},"Observed on the page"," lists objective signals extracted by blacklens itself – a password field, the brand name, a form posting to a foreign domain – while the ",[29,540,541],{},"Assessment"," is the interpretation. Only once the evidence is complete (the checklist shows 5\u002F5) is the ",[20,544,545],{},"Draft abuse report"," unlocked: a pre-filled, factual email to the registrar's abuse contact. Sending it is up to you.",[413,548,550],{"id":549},"getting-to-the-right-view-faster-ask-instead-of-building-filters","Getting to the right view faster: ask instead of building filters",[16,552,553,554,453],{},"Prioritisation often starts with a simple question: \"Show me critical findings on prod hosts.\" That is exactly how you can ask it now – on 17 dashboard lists, blacklens translates the description into a ready-made, editable filter query with a preview. The language model never sees your data at any point, only field names, types and permitted values – and nothing runs until you click ",[29,555,556],{},"Apply filters",[16,558,559,560,475,563,475,566,569,570,573,574,198,577,580],{},"Complementing this is the new status strip above every attack surface list: five metrics per page – such as ",[29,561,562],{},"Exposing",[29,564,565],{},"Vulnerable",[29,567,568],{},"High risk"," – many of them clickable as filters. And a principle we like to quote: ",[20,571,572],{},"Unknown never counts as safe."," Tiles such as ",[29,575,576],{},"Public",[29,578,579],{},"No MFA"," only count what a provider has explicitly reported.",[413,582,584],{"id":583},"on-your-terms","On your terms",[16,586,587,588,591,592,595],{},"The intelligent features of this release – Remediation Plan, finding explanations, domain verdicts, natural-language search – are ",[20,589,590],{},"opt-in per workspace"," and switched off initially after the update. Workspace admins decide under ",[20,593,594],{},"Settings → General → AI Features",", and \"off\" means off: the server rejects such requests for deactivated workspaces. The analyses run on our self-hosted LLM and are GDPR-compliant – your data never leaves our infrastructure.",[413,597,599],{"id":598},"conclusion","Conclusion",[16,601,602],{},"Less time sorting, more time fixing: this release turns the flood of findings into a reasoned order – a plan with the greatest risk leverage at the top, context and threat intelligence on every finding, evidence instead of gut feeling for lookalike domains. The intelligence lies in the prioritisation. Control stays with you.",[16,604,605,608,609,611,612,453],{},[20,606,607],{},"Get started:"," Workspace admins enable the features under ",[29,610,594],{},". After that, your first Remediation Plan is waiting under ",[29,613,422],{},{"title":350,"searchDepth":351,"depth":351,"links":615},[616,618,619,620,621,622],{"id":415,"depth":617,"text":416},2,{"id":459,"depth":617,"text":460},{"id":519,"depth":617,"text":520},{"id":549,"depth":617,"text":550},{"id":583,"depth":617,"text":584},{"id":598,"depth":617,"text":599},"release","2026-09-02","What first, why, and how? blacklens turns open findings into a prioritised remediation plan – sorted by risk reduction, with context on every finding.",[627,630,633],{"q":628,"a":629},"What is the blacklens Remediation Plan?","The Remediation Plan, found under Vulnerabilities → Remediation, turns all open external, internal and cloud findings into a prioritised action plan at the push of a button. Findings are grouped by the fix that resolves them, sorted by risk reduction and delivered with a rationale, an effort estimate and numbered steps, while progress counters update as your team works through the plan.",{"q":631,"a":632},"How does blacklens help prioritise vulnerabilities beyond the CVSS score?","Every finding receives an explanation layer with a suggested urgency, an exploit status chip and threat intelligence per CVE, including CVSS, EPSS, exploit or PoC availability, attack vector and advisory link. Root cause, impact, remediation steps and compensating controls are provided, and a chat on the finding answers follow-up questions in the context of your workspace.",{"q":634,"a":635},"Are the AI features in blacklens enabled by default, and where does the data go?","No. Remediation Plan, finding explanations, domain verdicts and natural-language search are opt-in per workspace and switched off after the update; workspace admins enable them under Settings → General → AI Features. The analyses run on blacklens' self-hosted LLM and are GDPR-compliant, so your data does not leave the blacklens infrastructure.","\u002Fimages\u002Finsights\u002F6a8eab1862da2619b8478b7d_Screenshot-2026-08-26-at-10.59.51.png",{},"\u002Fen\u002Finsights\u002Fwas-zuerst-intelligente-schwachstellen-priorisierung-mit-blacklens",{"title":391,"description":625},{"loc":638,"images":641},[642],{"loc":516},"en\u002Finsights\u002Fwas-zuerst-intelligente-schwachstellen-priorisierung-mit-blacklens",[645],"Release notes","was-zuerst-intelligente-schwachstellen-priorisierung-mit-blacklens","e1t1-bD9PIM1yFeHDE2AjNbJbYmYRx1HL1rehDCrysg",{"id":649,"title":650,"author":6,"body":651,"category":359,"date":702,"description":703,"draft":362,"extension":363,"faq":704,"image":713,"imageAlt":375,"lang":376,"legacyUrl":375,"meta":714,"navigation":378,"path":715,"readingTime":351,"seo":716,"sitemap":717,"stem":718,"tags":719,"translation":720,"updated":375,"__hash__":721},"insightsEn\u002Fen\u002Finsights\u002Ffortibleed-wenn-zehntausende-firewalls-zur-offenen-tur-werden.md","FortiBleed: When Tens of Thousands of Firewalls Become an Open Door",{"type":8,"value":652,"toc":696},[653,656,660,663,666,670,673,676,679,683,686,689,693],[16,654,655],{},"FortiGate firewalls protect corporate networks. That is their sole purpose. What FortiBleed shows: when the firewall itself becomes the attack surface, it no longer protects – it opens up.",[413,657,659],{"id":658},"what-is-fortibleed","What is FortiBleed?",[16,661,662],{},"FortiBleed is not a single breach. It is an industrialised harvesting operation against internet-exposed Fortinet firewalls and SSL VPN gateways. The dataset was discovered in mid-June 2026 by security researcher Volodymyr \"Bob\" Diachenko.",[16,664,665],{},"The scale is extraordinary – even though the exact figures vary by source and are still changing, as the campaign was still active at the time of publication. Security researchers who analysed the leaked dataset estimate the number of affected FortiGate devices at somewhere between 30,000 and 75,000. The entries it contains can be attributed to around 21,600 domains in 194 countries – a cross-section of global corporations, public authorities and critical infrastructure operators across almost every industry.",[413,667,669],{"id":668},"how-the-attack-worked","How the attack worked",[16,671,672],{},"The attack follows an automated, self-reinforcing chain. First, the internet is scanned for reachable FortiGate devices – above all SSL VPN endpoints and management interfaces. Against each device found, the attackers then test a curated list of known passwords. A successful login is not followed by a noisy attack – instead, the compromised device is used as a silent \"listening post\": it sits at the network perimeter and reads the traffic passing through in order to harvest further credentials. These flow back into the scanner and compromise the next device. The system feeds itself.",[16,674,675],{},"The password list being tested is not random. It consists of credentials that had already leaked in earlier Fortinet incidents and via infostealer logs – many organisations never changed their passwords after a previous incident. In addition, according to Diachenko's reconstruction, the attackers intercepted SSL VPN authentication hashes and cracked them offline with a GPU cluster (a Hashtopolis-managed setup of around 45 GPUs has been reported).",[16,677,678],{},"As things stand, this is not a confirmed zero-day. How the configuration data originally left the devices remains open: candidates include known but unpatched vulnerabilities (in particular CVE-2026-24858, a FortiCloud SSO SAML bypass with a CVSS score of up to 9.8), a still-unknown flaw, infostealer credentials, or a combination of these. A further contributing factor is that on many devices admin passwords are still stored in the older SHA-256 format – namely wherever admins never logged in again after a firmware update. In any case, the core of the problem remains the same: exposed management interfaces and reused or crackable credentials.",[413,680,682],{"id":681},"the-role-of-infostealers","The role of infostealers",[16,684,685],{},"A significant share of the credentials does not come from classic brute force but from infostealer campaigns. Infostealer malware on employee devices steals saved VPN credentials and passwords from browsers and password managers before they end up in dark web forums and dumps. In many cases these credentials enabled a valid login without any brute force at all.",[16,687,688],{},"That also makes FortiBleed a dark web monitoring topic: the infostealer activity that led to these credentials was visible in the relevant forums and dumps – to anyone actively looking there.",[413,690,692],{"id":691},"what-helps-and-why-visibility-is-decisive","What helps – and why visibility is decisive",[16,694,695],{},"This is exactly where blacklens.io comes in. Dark Web Monitoring detects when credentials or infostealer activity affect your own company – the Emerging Threat Notification System informs you proactively, before someone else reacts. Continuous attack surface analysis shows which systems are really reachable from the outside – including the ones nobody internally remembers any more.",{"title":350,"searchDepth":351,"depth":351,"links":697},[698,699,700,701],{"id":658,"depth":617,"text":659},{"id":668,"depth":617,"text":669},{"id":681,"depth":617,"text":682},{"id":691,"depth":617,"text":692},"2026-08-06","FortiGate firewalls exist to protect corporate networks. FortiBleed shows what happens when the firewall itself becomes the attack surface – and opens the door.",[705,707,710],{"q":659,"a":706},"FortiBleed is an industrialised credential-harvesting operation against internet-exposed Fortinet FortiGate firewalls and SSL VPN gateways, discovered in mid-June 2026 by security researcher Volodymyr Diachenko. Estimates put the number of affected devices between 30,000 and 75,000, spread across roughly 21,600 domains in 194 countries.",{"q":708,"a":709},"How did the FortiBleed attackers gain access to FortiGate devices?","The attackers scanned the internet for exposed SSL VPN endpoints and management interfaces and tested curated lists of previously leaked passwords and infostealer credentials against them. Compromised devices were then used as silent listening posts to harvest further credentials, and intercepted VPN authentication hashes were cracked offline on a GPU cluster.",{"q":711,"a":712},"How can companies protect themselves against attacks like FortiBleed?","Keep management interfaces off the public internet, rotate every credential that may have leaked in earlier incidents and enforce MFA on VPN access. Dark web monitoring detects leaked credentials and infostealer activity affecting your company early, and continuous attack surface analysis shows which systems are actually reachable from outside.","\u002Fimages\u002Finsights\u002F6a33e0062536b90c9b6edd6f_FortiBleed.png",{},"\u002Fen\u002Finsights\u002Ffortibleed-wenn-zehntausende-firewalls-zur-offenen-tur-werden",{"title":650,"description":703},{"loc":715},"en\u002Finsights\u002Ffortibleed-wenn-zehntausende-firewalls-zur-offenen-tur-werden",[385],"fortibleed-wenn-zehntausende-firewalls-zur-offenen-tur-werden","PneGkfhcZR06I9jQQwlU1RBHTQ-Dg_89axBdXXbdu8k",{"id":723,"title":724,"author":6,"body":725,"category":786,"date":787,"description":788,"draft":362,"extension":363,"faq":789,"image":799,"imageAlt":375,"lang":376,"legacyUrl":375,"meta":800,"navigation":378,"path":801,"readingTime":617,"seo":802,"sitemap":803,"stem":804,"tags":805,"translation":807,"updated":375,"__hash__":808},"insightsEn\u002Fen\u002Finsights\u002Faccess-broker-economy-wenn-der-zugang-zu-eurem-netzwerk-im-darknet-zum-verkauf.md","Access Broker Economy: When Network Access Is Sold on the Dark Web",{"type":8,"value":726,"toc":780},[727,731,738,741,744,748,751,754,757,761,764,767,771,774,777],[413,728,730],{"id":729},"initial-access-brokers-an-industry-of-their-own","Initial Access Brokers – an industry of their own",[16,732,733,734,737],{},"The dark web has developed a functioning division of labour. ",[20,735,736],{},"Initial Access Brokers (IABs)"," are specialised actors who concentrate on a single task: obtaining access to corporate networks and reselling that access.",[16,739,740],{},"Their offering is precisely catalogued and includes VPN credentials with details of company name, industry and annual revenue, RDP access to specific servers, compromised admin accounts with known privilege levels, and active sessions to Citrix or VMware environments. Buyers – including ransomware groups, espionage actors and extortionists – know exactly what they are getting before they even complete the purchase.",[16,742,743],{},"Prices depend on the value of the target. Access to a mid-sized European industrial company with high revenue fetches considerably more than access to a small service provider. The market runs on supply and demand.",[413,745,747],{"id":746},"why-this-division-of-labour-is-dangerous","Why this division of labour is dangerous",[16,749,750],{},"For affected companies this model means a structural shift: the actual breach – the moment someone gains unauthorised access – is not the same as the moment the damage becomes visible.",[16,752,753],{},"By the time ransomware is deployed, the initial access may be weeks old. During that time the original attacker has explored the network, documented credentials, prepared the listing and found the buyer. The ransomware actor walks into an environment that has already been opened up.",[16,755,756],{},"Classic reaction patterns come too late here: anyone who only reacts once files are being encrypted has already missed the decisive window.",[413,758,760],{"id":759},"what-the-dark-web-says-about-your-company","What the dark web says about your company",[16,762,763],{},"IAB listings are often surprisingly extensive. Alongside the access route and company name, they frequently include the number of reachable systems, the privilege level of compromised accounts, the security software in use and sometimes even hints about which EDR solutions are already present and would need to be bypassed in a follow-up attack.",[16,765,766],{},"This information does not come from database leaks. It was actively extracted from the network before the listing was created. An IAB entry means: someone was already inside.",[413,768,770],{"id":769},"how-blacklensio-detects-iab-activity","How blacklens.io detects IAB activity",[16,772,773],{},"blacklens.io's Dark Web Monitoring does not only track classic credential dumps – leaked email\u002Fpassword combinations from known breaches. It also captures active IAB listings on the relevant dark web forums and marketplaces.",[16,775,776],{},"If a listing is discovered that is linked to a company's public domain, an alert is issued immediately with all available context on the entry in question, such as the time of publication or the affected access point, for example a Citrix or VPN login page.",[16,778,779],{},"This is exactly where the difference to classic, reactive incident response lies: an IAB finding does not necessarily mean the actual attack has already taken place. Rather, it shows that a compromise has already occurred and that a follow-on attack could be imminent – which often leaves a limited window for targeted countermeasures.",{"title":350,"searchDepth":351,"depth":351,"links":781},[782,783,784,785],{"id":729,"depth":617,"text":730},{"id":746,"depth":617,"text":747},{"id":759,"depth":617,"text":760},{"id":769,"depth":617,"text":770},"analysis","2026-06-18","Ransomware attacks rarely start with the ransomware. They start with a compromised account or stolen credentials – sold on by Initial Access Brokers.",[790,793,796],{"q":791,"a":792},"What is an Initial Access Broker (IAB)?","An Initial Access Broker is a specialised cybercriminal who obtains access to corporate networks – via VPN credentials, RDP access, compromised admin accounts or active Citrix and VMware sessions – and resells it on dark web forums and marketplaces. Buyers include ransomware groups, espionage actors and extortionists, and prices depend on the value of the target.",{"q":794,"a":795},"Why are IAB listings so dangerous for companies?","An IAB listing means someone has already been inside the network: the details it contains, such as reachable systems, privilege levels and the security software in use, were actively extracted before the sale. By the time ransomware is deployed, the initial access may be weeks old, so reacting only once files are encrypted is far too late.",{"q":797,"a":798},"How does blacklens.io detect Initial Access Broker activity?","blacklens.io's dark web monitoring tracks not only classic credential dumps but also active IAB listings on the relevant forums and marketplaces. If a listing linked to a company's public domain is found, an immediate alert with all available context is issued, which usually leaves a limited window for targeted countermeasures before a follow-on attack.","\u002Fimages\u002Finsights\u002F6a02cb6bd260765318d73c18_7e604755-67bf-4cf9-891c-b14db6012c06.png",{},"\u002Fen\u002Finsights\u002Faccess-broker-economy-wenn-der-zugang-zu-eurem-netzwerk-im-darknet-zum-verkauf",{"title":724,"description":788},{"loc":801},"en\u002Finsights\u002Faccess-broker-economy-wenn-der-zugang-zu-eurem-netzwerk-im-darknet-zum-verkauf",[806],"Analysis","access-broker-economy-wenn-der-zugang-zu-eurem-netzwerk-im-darknet-zum-verkauf","iVgFI5xW1mfYm3QbYA3RaQ9hwi04Yi-mGyaWZrF2Xw0",1789638254588]