# FortiBleed Credential-Harvesting Campaign Feeds INC Ransom and Lynx Ransomware-as-a-Service Operations

> A Russian-speaking Initial Access Broker's FortiBleed campaign has weaponized the legitimate FortiOS `diagnose sniffer packet` diagnostic command via a custom Golang tool, FortigateSniffer, to passively harvest 110M+ authentication credentials from 430,000+ internet-facing FortiGate firewalls across 150+ countries. SOCRadar's Threat Research Unit (STRU) obtained an operational-security lapse that exposed the actor's infrastructure, tooling, and internal logs, revealing that harvested access is fed directly into at least 12 confirmed ransomware deployments and that a single operator held live negotiation-panel sessions for both the INC Ransom and Lynx RaaS operations.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1056
- **ID:** TL-2026-1056
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** FortiBleed IAB (Russia)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

FortiBleed is not a discrete CVE-driven vulnerability but a technique-abuse campaign: attackers repurpose FortiOS's built-in `diagnose sniffer packet` administrative command — normally used by network engineers to troubleshoot connectivity — to passively capture authentication traffic in cleartext and hashed form across roughly two dozen protocols (NTLM, Kerberos, RADIUS, RDP, LDAP, MSSQL) traversing compromised FortiGate appliances. The campaign begins with mass reconnaissance using Masscan and Shodan (via a custom Shodan_Recon enrichment tool and a FortiProbe-fast binary filter) to identify internet-exposed FortiGate management interfaces and SSL-VPN portals, alongside adjacent scanning of Sophos SSL-VPN and RDWeb portals. Operators then conduct SSH brute-force (using 16 FortiGate-convention wordlists) and credential-stuffing attacks against administrative and SSL-VPN accounts to obtain initial admin-level access. Once inside, they deploy FortigateSniffer — a Golang binary built for both Linux and Windows targets — to run the sniffer continuously, timed to operate only 07:00-18:00 Moscow time to blend with legitimate diagnostic traffic and administrator working hours. Captured hashes are shipped to a distributed GPU cracking cluster (Hashtopolis orchestrating Hashcat, with compute rented from vast.ai) and, per some reporting, a purpose-built CyberStrike automation framework. Cracked and replayed credentials (including session-cookie replay) are used to pivot from firewall admin access into VPN, then Active Directory domain controllers, culminating in domain-admin compromise; operators reportedly also planted persistent backdoor accounts named "adminin" for durable access. Post-compromise, actors traverse Active Directory, stage data via DFS backup shares, and exfiltrate before selling or directly monetizing access. Confirmed admin-level access was achieved on 409 targets and full attack-chain (domain) compromise on 354 organizations, out of roughly 80,000 identified and ~11,000-19,000 actively sniffed devices at peak (scaled down after vendor/researcher notification). Infrastructure spans 200-500+ operational servers hosted on Eastern European micro-hosting providers, segmented into distinct subnet blocks for C2 aggregation, credential validation, sniffer deployment, and proxy rotation; Cyrillic-language code comments and Russian/Ukrainian-hosted infrastructure support a Russian-origin assessment. The actor also leveraged a previously undisclosed Nextcloud zero-day for post-compromise access expansion, reportedly under coordinated/responsible disclosure, and is under investigation for AI-assisted vulnerability research. Victimology skews toward small-to-medium organizations (66% under 200 employees, 90% under $100M revenue) and IT/MSP services firms, with confirmed breaches extending to a NATO-aligned defense contractor (Kerberos hash cracking and data exfiltration confirmed June 15, 2026) and organizations in healthcare, education, and government sectors. SOCRadar's decisive finding is operational overlap: a Windows server within FortiBleed's own infrastructure retained active browser sessions logged into the negotiation/chat panels of both the INC Ransom and Lynx ransomware-as-a-service platforms, directly tying mass credential harvesting to at least 12 confirmed ransomware deployments with hundreds of endpoints encrypted. INC Ransom has operated as a RaaS platform since mid-2023, targeting industrial, healthcare, and education sectors via spearphishing, exploitation of internet-facing applications, RDP lateral movement, and Rclone/Megasync-based exfiltration ahead of double-extortion encryption. Lynx, which emerged roughly a year after INC and is widely assessed by researchers (Palo Alto Unit 42, Group-IB) as a rebrand/evolution of the INC codebase, uses Curve25519-Donna plus AES-128-CTR encryption, appends the `.lynx` extension to encrypted files, drops `README.txt` ransom notes, changes desktop wallpaper to `background-image.jpg`, and terminates backup/database services (MSSQL, Exchange, Veeam) and deletes Volume Shadow Copies prior to encryption. SOCRadar has indicated a forthcoming second technical whitepaper with additional IOCs and attribution evidence.

## MITRE ATT&CK

- T1595.001 Scanning IP Blocks
- T1596 Search Open Technical Databases
- T1587.001 Malware
- T1588.002 Tool
- T1583.004 Server
- T1110 Brute Force
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1136.001 Local Account
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1550.004 Web Session Cookie
- T1070 Indicator Removal
- T1036 Masquerading
- T1040 Network Sniffing
- T1110.002 Password Cracking
- T1110.004 Credential Stuffing
- T1552 Unsecured Credentials
- T1018 Remote System Discovery
- T1016 System Network Configuration Discovery
- T1087.002 Domain Account
- T1021.001 Remote Desktop Protocol
- T1550 Use Alternate Authentication Material
- T1074.002 Remote Data Staging
- T1105 Ingress Tool Transfer
- T1102.002 Bidirectional Communication
- T1567.002 Exfiltration to Cloud Storage
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [FortiBleed Password Stealing Attack Linked to INC and Lynx Ransomware Operations](https://cybersecuritynews.com/fortibleed-password-stealing-attack/)
- [SOCRadar Links FortiBleed Campaign to INC and Lynx Ransomware Operations](https://socradar.io/blog/fortibleed-inc-lynx-ransomware-link/)
- [FortiBleed credential-theft campaign linked to Lynx ransomware](https://www.bleepingcomputer.com/news/security/fortibleed-credential-theft-campaign-linked-to-lynx-ransomware/)
- [FortiBleed: 86,644 Fortinet Firewalls Compromised — SOCRadar Research](https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/)
- [What Is FortiBleed? Fortinet Credential Theft Campaign Explained](https://socradar.io/blog/what-is-fortibleed/)
- [Dismantling FortiBleed: Inside a Russian Fortinet Compromise Operation](https://socradar.io/resources/whitepapers/dismantling-fortibleed-inside-a-russian-fortinet-compromise-operation/)
- [FortiBleed campaign used custom FortiGate sniffer to steal credentials](https://www.bleepingcomputer.com/news/security/fortibleed-campaign-used-custom-fortigate-sniffer-to-steal-credentials/)
- [Russian Initial Access Broker Behind FortiBleed Campaign](https://www.securityweek.com/russian-initial-access-broker-behind-fortibleed-campaign/)
- [FortiBleed Campaign Uses FortigateSniffer to Harvest 110 Million Credentials From Fortinet Firewalls](https://gbhackers.com/fortibleed-campaign-uses-fortigatesniffer-to-harvest-110-million-credentials/)
- [FortiBleed: The Most Detailed Breakdown Yet of an Active Russian Credential-Harvesting Operation](https://securityaffairs.com/194004/hacking/fortibleed-the-most-detailed-breakdown-yet-of-an-active-russian-credential-harvesting-operation.html)
- [FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist](https://www.darkreading.com/cyberattacks-data-breaches/fortibleed-attackers-firewalls-credentials-stealers)
- [FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems](https://www.recordedfuture.com/blog/critical-fortibleed-campaign)
- [INC Ransom, GOLD IONIC, Group G1032 | MITRE ATT&CK](https://attack.mitre.org/groups/G1032/)
- [Lynx Ransomware: Exposing How INC Ransomware Rebrands Itself](https://www.picussecurity.com/resource/blog/lynx-ransomware)
- [Lynx Ransomware: A Rebranding of INC Ransomware - Unit 42](https://unit42.paloaltonetworks.com/inc-ransomware-rebrand-to-lynx/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1056