FortiBleed theft linked to INC and Lynx ransomware

A large-scale cyber campaign that stole credentials from hundreds of thousands of Fortinet firewalls worldwide has been directly linked to two active ransomware operations, according to new findings from threat intelligence researchers. The campaign, known as FortiBleed, is now confirmed to be feeding the INC Ransom and Lynx ransomware-as-a-service groups, marking the first time mass credential theft from FortiGate devices has been directly connected to ransomware deployment.

Researchers from SOCRadar’s Threat Research Unit (STRU) identified an operator with access to FortiBleed’s infrastructure who was actively logged into the negotiation panels for both ransomware groups, handling ransom demands in real time. This direct link was established after an operational security lapse exposed one of the campaign’s servers, granting investigators visibility into internal files, logs, and documentation.

The FortiBleed campaign, which came to light in June 2026, initially involved the systematic scanning of the internet for exposed Fortinet devices. Attackers used a custom tool written in Go, called FortigateSniffer, which passively intercepted authentication traffic by abusing a...