In this session, Viktor Hedberg, Heresh Zaremand, and Jean‑François Gobin share real-world insights from responding to incidents related to the FortiBleed credential harvesting campaign and its real-world exploitation across enterprise environments.
Drawing on firsthand experience as incident responders from this campaign and for instance the FortiCloud SSO Vulnerability, the speakers break down how threat actors have leveraged vulnerabilities and misconfigurations in the wild—from initial access and credential exposure to persistence and lateral movement. The discussion moves beyond theoretical risk, focusing instead on what has actually been observed across impacted environments, including common attacker patterns, tooling, and operational behaviors.