FortiBleed Credential-Theft Campaign Linked to INC and Lynx Ransomware Operations

FortiBleed Credential-Theft Campaign Linked to INC and Lynx (TL-2026-1085), also tracked as FortiBleed, is a critical-severity ransomware operation, first published 2026-07-02. It is attributed to FortiBleed Operator (Russia) with medium confidence, affects Fortinet FortiGate Firewalls / SSL-VPN, maps to 25 MITRE ATT&CK techniques (T1003, T1018, T1021), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-1085

Threat ID
TL-2026-1085
Also known as
FortiBleed, FortiGate Sniffer Campaign, FortigateSniffer Campaign
Severity
CRITICAL
Status
ACTIVE
Category
RANSOMWARE
First published
2026-07-02
Last reviewed
2026-07-02
Attribution
FortiBleed Operator
Attribution confidence
MEDIUM
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
itservicesmsp, health, education, government administration, defense, finance, smbenterprise
Target regions
india, united states of america, taiwan, Europe, North America, Asia-Pacific, Global
Detection rules
9
Indicators of compromise
21

Malware and tooling in FortiBleed Credential-Theft Campaign Linked to INC and Lynx

Malware and tooling: FortigateSniffer, CyberStrike Harvester v1.5, FortiProbe-fast, HASHBOT, Hashcat, Hashtopolis, Masscan, Shodan_Recon, Telegram (HASHBOT orchestration channel), forticheck

SOCRadar's Threat Research Unit (STRU) linked the FortiBleed mass credential-harvesting campaign — which used a custom Golang packet sniffer abusing the FortiOS `diagnose sniffer packet` command against 430,000+ FortiGate firewalls worldwide — to the INC Ransom and Lynx ransomware-as-a-service operations. A single operator was found logged into the negotiation panels of both groups using infrastructure traceable to FortiBleed, with at least 12 ransomware deployments and over 110 million harvested credentials tied to the campaign.

How FortiBleed Credential-Theft Campaign Linked to INC and Lynx works

FortiBleed is a large-scale, financially motivated credential-harvesting operation active since at least February 2026 that abuses a legitimate FortiOS diagnostic feature — the `diagnose sniffer packet` command — via a custom Golang tool dubbed FortigateSniffer (also referenced as FortiGate Sniffer) to passively capture authentication traffic traversing compromised FortiGate firewalls. No FortiOS vulnerability or zero-day is required for initial compromise: threat actors gain access to devices through mass scanning (Masscan, Shodan, and a custom FortiProbe-fast filtering binary), SSH brute-forcing with FortiGate-specific wordlists, and SSL-VPN credential stuffing/dictionary attacks via a tool referred to as "forticheck." Once administrative access is obtained, the operators deploy FortigateSniffer to passively intercept authentication material across roughly two dozen protocols (Kerberos, NTLM, RADIUS, RDP, LDAP, TACACS+, RPC, SMB, SMTP, FTP, Telnet, WinRM, MS-SQL, MySQL, PostgreSQL) without dropping traditional malware, evading many endpoint-based detections.

SOCRadar's STRU discovered a persistent backdoor account (username "adminin", credential pair adminin:ITAdmin@888) planted on thousands of compromised devices — found on 3,947 distinct devices in a validated-credentials cache, including 1,562 instances in a single EU-focused batch — indicating provisioned rather than organically reused accounts. Harvested credentials (110+ million records, including 14.8M RADIUS, 924K NTLM hashes, 130K Kerberos hashes, and 89M MySQL authentication tokens) are processed through a Go-based ELF credential-extraction tool called CyberStrike Harvester v1.5, and password hashes are cracked at scale using Hashcat orchestrated through Hashtopolis against rented vast.ai GPU capacity, coordinated by a Telegram bot named HASHBOT. Operational tradecraft indicates a disciplined, professionalized crew: activity is geofenced and restricted to 07:00-18:00 Moscow time to blend with legitimate business traffic, tooling contains Cyrillic-language code comments suggesting Russian-speaking operators, and infrastructure is segmented across four subnet blocks hosted on Eastern European micro-hosting providers dedicated respectively to C2 aggregation, credential validation, sniffer deployment, and proxy rotation. Investigators also found a pentest-lab-style back-end (seven Kali Linux VMs under QEMU/KVM, hardened iptables, shared tmux sessions for multi-operator access) supporting an estimated 20-person team with defined roles.

The campaign has targeted more than 430,000 FortiGate devices across 150+ countries, with roughly 11,250 FortiGate portals actively scanned, admin-level access confirmed on 409 targets, and full domain compromise achieved on 354 of those — with traffic sniffers actively running on approximately 19,000 devices at peak (reduced to roughly 11,000 following vendor/CERT notifications). Between May 19 and June 15, 2026, at least 659 distinct credential-harvesting pipelines were launched. Post-compromise, operators pivot from firewall/VPN credential theft to Active Directory lateral movement, Kerberos hash cracking, and DFS backup exfiltration; SOCRadar also assesses the group may have exploited a previously undisclosed Nextcloud zero-day to expand access after initial compromise, though full technical details of that vulnerability have not been publicly released. A confirmed victim includes a NATO-aligned defense contractor, where exfiltration of DFS backup data began within minutes of an offline Kerberos hash crack completing. Victimology skews toward SMBs (66% under 200 employees, 90% under $100M revenue) concentrated in India, the United States, and Taiwan (~33% combined), with IT/MSP services as a primary target sector — likely valued for downstream access to MSP customer networks — alongside healthcare, education, and government targets identified via ransomware-panel overlap.

The pivotal escalation documented in this research: SOCRadar's STRU, while investigating a Windows staging server used by the FortiBleed operators (containing downloaded FortiGate configuration files, harvested credentials, and password-cracking infrastructure), found the same operator actively logged into the ransomware negotiation/victim-management panels of both the INC Ransom and Lynx ransomware-as-a-service platforms — the first documented direct link tying mass Fortinet credential harvesting to an active ransomware deployment pipeline. Victim data harvested during FortiBleed operations overlaps with organizations later listed on the INC ransomware leak site. INC Ransom has operated as a RaaS platform since mid-2023; Lynx, believed to be an INC rebrand or close affiliate, emerged roughly a year later in mid-2024. SOCRadar attributes at least 12 confirmed ransomware deployments and 354 completed FortiGate intrusions to access obtained through FortiBleed, with hundreds of endpoints encrypted across affected victim organizations.

MITRE ATT&CK techniques used in TL-2026-1085

Credential Access

T1003 OS Credential Dumping; T1040 Network Sniffing; T1110 Brute Force; T1552 Unsecured Credentials; T1558 Steal or Forge Kerberos Tickets

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery; T1087 Account Discovery

Lateral Movement

T1021 Remote Services

Defense Evasion

T1036 Masquerading; T1078 Valid Accounts

Collection

T1039 Data from Network Shared Drive; T1119 Automated Collection

Exfiltration

T1041 Exfiltration Over C2 Channel

Command and Control

T1071 Application Layer Protocol; T1090 Proxy

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Persistence

T1078 Valid Accounts; T1136 Create Account

Privilege Escalation

T1078 Valid Accounts

Impact

T1486 Data Encrypted for Impact

Resource Development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities

Reconnaissance

T1595 Active Scanning

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in FortiBleed Credential-Theft Campaign Linked to INC and Lynx

  • Fortinet — FortiGate Firewalls / SSL-VPN
    Vulnerable versions: FortiOS devices with internet-facing admin/SSL-VPN access and weak or default credentials
    Fixed in: No vendor patch applicable; mitigation is credential hygiene, access restriction, and disabling unnecessary diagnostic CLI access
  • Nextcloud — Nextcloud (suspected zero-day, undisclosed)
    Vulnerable versions: Unconfirmed — SOCRadar assesses a previously undisclosed zero-day was used for post-compromise access expansion; technical details not yet released
    Fixed in: Not yet available
  • Multiple — Synology NAS, Sophos Firewalls, Citrix SSL-VPN, Microsoft SQL Server (secondary targeting since Feb 28, 2026)
    Vulnerable versions: Internet-facing instances with weak/reused credentials
    Fixed in: N/A — credential hygiene and access restriction

Remediation for FortiBleed Credential-Theft Campaign Linked to INC and Lynx

Patches

  • No CVE/vendor patch has been publicly attributed to FortiBleed initial access — compromise stems from credential reuse, weak/default authentication, and abuse of a legitimate diagnostic feature, not an unpatched vulnerability
  • Monitor Nextcloud advisories for disclosure of the suspected zero-day referenced by SOCRadar and apply the patch immediately once released

Immediate actions

  • Rotate ALL credentials (VPN, admin, RADIUS, LDAP, local, service accounts) on any FortiGate device that has been internet-facing with SSL-VPN or admin access exposed
  • Audit all local and remote FortiGate admin accounts for the backdoor username 'adminin' or the credential pair adminin:ITAdmin@888 and remove immediately if found
  • Disable or tightly restrict the FortiOS 'diagnose sniffer packet' command via administrative profile restrictions and CLI access controls; audit CLI/API logs for its use
  • Restrict FortiGate administrative and SSL-VPN interfaces to trusted management networks only; disable internet-facing admin/VPN portals where not operationally required
  • Force re-authentication and invalidate all active VPN sessions on potentially compromised devices
  • Hunt for anomalous outbound connections to Eastern European micro-hosting ranges during 07:00-18:00 Moscow time (04:00-15:00 UTC)
  • Review Active Directory for anomalous Kerberos ticket requests, NTLM authentication spikes, and DFS access/exfiltration patterns following any suspected FortiGate compromise

Workarounds

  • Restrict or disable the 'diagnose sniffer packet' CLI command for non-essential administrative roles
  • Enforce strong, unique, non-default credentials on all FortiGate admin and VPN accounts; disable password-only authentication in favor of certificate-based or MFA-backed authentication
  • Geofence and rate-limit administrative and SSL-VPN login attempts to reduce brute-force/credential-stuffing exposure

Longer-term hardening

  • Deploy MFA on all FortiGate SSL-VPN and administrative access points
  • Implement network segmentation isolating firewall management planes from general enterprise traffic
  • Deploy EDR/NDR with behavioral detection tuned to detect credential-sniffing abuse of legitimate diagnostic commands rather than signature-based malware detection
  • Establish continuous monitoring for ransomware-panel/leak-site victim overlap correlated against known compromised-asset inventories
  • Adopt a formal patch/config management cadence for perimeter security appliances (firewalls, VPN gateways) given their status as a primary initial-access vector industry-wide
  • Monitor for and patch Nextcloud instances proactively pending disclosure of the suspected zero-day used for post-compromise access expansion

Weaknesses (CWE) in FortiBleed Credential-Theft Campaign Linked to INC and Lynx

CWE-798, CWE-306, CWE-522, CWE-1188, CWE-287

Timeline of FortiBleed Credential-Theft Campaign Linked to INC and Lynx

  • FortiBleed campaign assessed as active since at least early February 2026, per SOCRadar STRU tracking.
  • Operators expand targeting scope to additional perimeter appliances including Synology NAS, Sophos firewalls, Citrix SSL-VPN, and Microsoft SQL Server instances alongside FortiGate devices.
  • FortiGate credential-capture cycle using FortigateSniffer commences at scale per SOCRadar telemetry.
  • Beginning of a surge window in which 659 distinct credential-harvesting pipelines are launched by the operators, running through June 15, 2026.
  • Initial public reporting describes a sweeping credential-harvesting operation compromising 30,000+ Fortinet devices.
  • SOCRadar publishes initial research identifying 86,644 compromised Fortinet firewall entries across 194 countries.
  • SecurityAffairs publishes a detailed technical breakdown attributing the operation to a likely Russian-speaking actor, citing Cyrillic tooling comments and Moscow-business-hours operational tempo.
  • End of the 659-pipeline credential-harvesting surge window that began May 31, 2026.
  • BleepingComputer and The Hacker News detail the FortigateSniffer tool's abuse of the FortiOS 'diagnose sniffer packet' command and report over 110 million harvested credentials across 430,000+ targeted FortiGate devices.
  • Arctic Wolf publishes reverse-engineering analysis of the CyberStrike Harvester v1.5 Go-based ELF credential-processing binary used by the operators.
  • SpyCloud publishes findings from inside the FortiBleed threat-actor infrastructure, corroborating credential-processing and cracking tooling.
  • SOCRadar STRU discloses that an operator tied to FortiBleed infrastructure was found actively logged into the ransomware negotiation panels of both the INC Ransom and Lynx ransomware-as-a-service operations, confirming at least 12 ransomware deployments and 354 completed FortiGate intrusions traced to harvested access.
  • Widespread security media coverage (SecurityWeek, Security Affairs, Techzine, TechTimes, Cybersecurity Dive) of the INC/Lynx ransomware attribution and the 430,000-device campaign scale.

Sources cited for FortiBleed Credential-Theft Campaign Linked to INC and Lynx

Threats related to FortiBleed Credential-Theft Campaign Linked to INC and Lynx

Detection coverage for TL-2026-1085

As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1085 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1085

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats