AI risk awareness is starting to turn into action. One finding from the @WEF Global Cybersecurity Outlook 2026 is worth revisiting: the share of organizations assessing the security of AI tools jumped from 37% to 64% year over year. 📈 Learn why that shift matters as organizations work to keep pace with the security implications of AI adoption. ow.ly/I1b750ZXORX

Cybercrime rarely operates alone. It’s one piece of a larger puzzle that includes financial crime, trafficking, and corruption. This month in Panama City, the people working to solve that puzzle come together. 🧩 At the @CSIWorld 2026 Global Summit, themed “Cooperation Against Converging Crime,” @FortiGuardLabs' Derek Manky will join leaders from law enforcement, government, industry, and civil society to share how cybersecurity expertise strengthens the broader response to interconnected crime. Through our Cybercrime Bounty program with CSI and our work with the Cybercrime Atlas, #Fortinet helps connect threat intelligence, community reporting, and investigative expertise. That turns isolated signals into coordinated action and makes criminal networks harder to sustain. 🔒 🔗 ow.ly/Ojx950ZXbnz

A good threat report tells you what happened. A threat-informed SOC asks a harder question: what should we do differently? 💬 #FortiGuardLabs’ Douglas Santos explains how mapping adversary TTPs to MITRE ATT&CK gives SecOps teams a more durable way to understand how attacks unfold and where defenses need attention. 🔗 See threat-informed SecOps in action: ow.ly/GUVs50ZXI8y

Need help getting through NAT? STUN. ❗️ Need help keeping a backdoor reachable? Also STUN. 😬 #FortiGuardLabs is tracking ClingSTUN, a Linux backdoor that exploits known, unpatched vulnerabilities in internet-facing IoT devices and abuses public STUN infrastructure to maintain connectivity. The catch? Those STUN services are legitimate, helping the traffic blend in with normal VoIP and WebRTC activity. 🔗 See how #ClingSTUN works and what to watch for: ow.ly/2BEA50ZUzzM

The disguise wasn’t a fake app. It was what attackers did after installation. 🎭 #FortiGuardLabs uncovered a #SectopRAT malware campaign where attackers tampered with an existing legitimate software installation to quietly load the RAT. Once active, SectopRAT can:
 → Steal browser credentials and payment data
 → Target crypto wallets and other applications 🔗 Read more from GBHackers: ow.ly/UgHv50ZUycP

CVSS 10.0. No authentication required. Active exploitation observed. 🚨 Our researchers are tracking CVE-2026-85706, a critical GitLab path traversal vulnerability that can allow attackers to read arbitrary files from vulnerable servers. With public exploit code available, unpatched GitLab instances may be exposed. 🔗 Get the full analysis and mitigation guidance: ow.ly/77jw50ZSKOf #FortiGuardLabs

Trusted name. Unexpected behavior. 🚨 💻 @DarkReading examines new #FortiGuardLabs research into a #SectopRAT variant hidden inside legitimate software, giving attackers a way to borrow trust while staying under the radar. The analysis uncovers how the malware was concealed, encrypted, and loaded to support remote control and data theft across compromised systems. 🔗 Read the latest: ow.ly/1W6q50ZSjwg

Looks legitimate. Runs legitimate. Carries a RAT. 🎭 Our team investigated a #SectopRAT variant concealed inside legitimate software and unpacked through a multi-stage loader before executing in memory. Once active, it gives attackers broad remote control, including screen capture, file and process management, command execution, and access to sensitive data from browsers, email clients, gaming platforms, and crypto wallets. 🔗 See how the payload stays hidden and what it can do: ow.ly/QvuS50ZR8Hz

WORKFLOW STATUS: APPROVED ✅ AUTHENTICATION: NOT REQUIRED 🚫 RESULT: OS COMMAND EXECUTION 🚨 That is the problem with CVE-2026-58138. #FortiGuardLabs is seeing active attack attempts against vulnerable Orkes Conductor deployments, where malicious workflow definitions can escape the intended scripting environment and execute commands on the underlying server. 🔗 Get the technical analysis: ow.ly/5SM150ZPb1l

For years, anonymity has worked in the cybercriminal's favor. What changes when it doesn't? @FortiGuardLabs Derek Manky and @CSIWorld's Hayley van Loon discuss how the Cybercrime Bounty program is designed to raise the cost of operating in the shadows by giving people a trusted, anonymous way to share what they know. The goal goes beyond disruption: accountability and deterrence. 🔗 See how Operation Silent Vector I is putting that model into action: ow.ly/njaL50ZO3yX

At @INTERPOL_HQ's 11th Americas Working Group on Cybercrime for Heads of Unit, Fortinet's Arturo E. Torres joined INTERPOL, the World Economic Forum (@wef) and Paraguayan authorities around a practical question: How do we turn threat intelligence into coordinated action across Latin America? 💬 This new blog shares how @FortiGuardLabs intelligence supports investigations and operations, and why disruption, not information sharing alone, is the real measure of public-private collaboration. 🔗 Read Arturo's perspective: ow.ly/gA5t50ZNT0L

Casbaneiro is getting harder to read on purpose. 🕵️‍♂️ #FortiGuardLabs uncovered a new campaign targeting Latin America that uses geofencing, staged loaders, selective activation, and separate servers for stolen data to make the #malware appear inactive or inaccessible during analysis. 🔗 Explore the attack chain: ow.ly/4pyo50ZMbSc

Someone else may be spending your AI budget. 💸🤖 #FortiGuardLabs analyzed an Amazon Bedrock LLMjacking incident where a leaked AWS IAM key was used to create a new identity, subscribe to foundation models, and generate inference charges on the victim’s account. Valid access. Real cost. 🔗 See how to spot LLMjacking: ow.ly/SFzZ50ZKIAl

🚨 New #FortiGuardLabs Outbreak Alert: WordPress Core Unauthenticated RCE The WP2Shell attack chain combines two critical vulnerabilities to enable remote code execution against vulnerable WordPress installations without authentication or user interaction. Read the latest and sign up for outbreak alerts today: ow.ly/gHWK50ZIUYl

As a founding partner of @FIRSTdotOrg, #Fortinet is helping expand training, cyber drills, regional engagement, and incident response readiness where it can make the greatest impact. This is capacity building, not just technology. It's investing in the people, skills, and relationships behind coordinated response. Great to see Derek Manky, our Chief Security Strategist and Global VP of Threat Intelligence at @FortiGuardLabs, featured in FIRST's video series on this work. 🔗 See what global collaboration looks like in practice: ow.ly/vrua50ZIRtM

From access brokers and botnets to ransomware affiliates and scam networks, @INTERPOL_HQ's African Cyberthreat Assessment Report 2026 shows a more specialized, automated, and borderless threat landscape. → AI is accelerating attacks. → Credentials remain a key target. → Cybercrime-as-a-Service lowers barriers. → Collaboration enables disruption. With contributions from @FortiGuardLabs, the report reinforces the need for coordinated intelligence sharing and public-private partnerships. 🔗 Read the analysis: ow.ly/swlO50ZIjGY

🚨 New #FortiGuardLabs Outbreak Alert: QuickFox Supply Chain Attack A trojanized Windows installer turned a trusted software path into a selective delivery mechanism for the FDMTP backdoor. Read more: ow.ly/6GYu50ZFpsc

🌎 In this week's "Improving Security Across Nations with @FIRSTdotOrg" video series, we spotlight Derek Manky, Chief Security Strategist and Global VP of Threat Intelligence at @Fortinet, and FIRST CORE Founding Partner. Watch here: go.first.org/3GtbN #cybersecurity

Mirai evolved. So did the risk. 🐧 Our researchers are tracking Evooo1Bot, a previously undocumented #Linux botnet that expands the familiar Mirai framework with a far more capable toolkit. → Exploit exposed devices → Steal credentials → Scan for SSH access → Turn compromised infrastructure into a proxy 🔗 Read the technical analysis: ow.ly/kgJc50ZzzAr

Detecting cybercrime is one thing. Identifying the people behind it is another. 🔍 At #BHUSA, Fortinet's Derek Manky spoke with @theCUBE about closing that accountability gap through the Cybercrime Bounty program with Crime Stoppers International. → Trusted, anonymous reporting → Human intelligence, not just technical indicators → Turning validated tips into actionable intelligence ⏯️ Watch the full interview: ow.ly/VNh350ZyB5N