In this session, Viktor Hedberg, Heresh Zaremand, and Jean‑François Gobin share real-world insights from responding to incidents related to the FortiBleed credential harvesting campaign and its real-world exploitation across enterprise environments.
Drawing on firsthand experience as incident responders, the speakers break down how threat actors have leveraged these vulnerabilities in the wild—from initial access and credential exposure to persistence and lateral movement. The discussion moves beyond theoretical risk, focusing instead on what has actually been observed across impacted environments, including common attacker patterns, tooling, and operational behaviors.