A large-scale cyber campaign that stole credentials from hundreds of thousands of Fortinet firewalls worldwide has been directly linked to two active ransomware operations, according to new findings from threat intelligence researchers.