Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)

Summary: Unit 42's threat brief describes attackers logging in with previously leaked username and password pairs, then pivoting to password spraying against internet-exposed services, and it covers two campaigns: TheHatman, whose posts from Aug. 1–17, 2026 offered to sell employee data allegedly exfiltrated from Microsoft Entra tenants, and FortiBleed, a password spraying and credential theft campaign against Fortinet devices first disclosed in June 2026 with observed attempts also targeting MSSQL and reported targeting of Sophos devices. Unit 42 says it could not verify TheHatman's claimed intrusion vector or its claims of MFA fatigue and password spraying, and that an initial access broker on the Russian-language forum Exploit[.]in claimed responsibility for the FortiBleed campaign and offered harvested credentials for sale on June 16, 2026, claims Unit 42 has not validated.

What you should know: The attackers build their password list from previous breaches and add each newly captured credential back into it for the next target, so one compromised account feeds the campaign against the next organization. Unit 42's recommended detection is a successful login shortly after a large volume of password failures, a pattern that only surfaces if remote access logs are actually being reviewed.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Identity & Access Management
Related