FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations

The recently discovered financially-motivated FortiBleed campaign has been attributed to INC and Lynx ransomware operations, indicating that the verified, stolen credentials were intended for follow-on intrusions. SOCRadar reported that an operator tied to FortiBleed’s infrastructure was found actively working negotiation panels for both groups, tying mass FortiGate credential theft directly to ransomware deployment for the first time.

The company tracked scanning activity against approximately 11,250 FortiGate portals in more than 150 countries, followed by confirmed admin-level access on 409 targets and successful completion of the full attack chain on 354 of them. At least 12 ransomware deployments have resulted from this access, causing hundreds of endpoints to be encrypted across affected organizations.

The large-scale credential-harvesting operation involved threat actors systematically scanning the internet for exposed Fortinet devices, attempting to break into them using known credential combinations, and deploying custom packet sniffers to passively gather credentials from network traffic. The campaign targeted 430,000 FortiGate firewalls globally, gathering over 110 million credentials. The activity was exposed after an operational security error left a server containing stolen credentials exposed on the internet.

The Golang sniffer was installed on about 12,000 Fortinet devices. SOCRadar discovered an internal document indicating an organized operation of about 20 people with a clear division of labor. The threat actors are also believed to be in possession of at least one zero-day vulnerability in Nextcloud. Separately, eSentire observed threat actors exploiting a flaw in Fortinet FortiClient EMS (CVE-2026-35616) to deploy EKZ Stealer for credential harvesting.