# FortiBleed Credential-Theft Campaign Linked to INC and Lynx Ransomware Operations

> SOCRadar's Threat Research Unit (STRU) linked the FortiBleed mass credential-harvesting campaign — which used a custom Golang packet sniffer abusing the FortiOS `diagnose sniffer packet` command against 430,000+ FortiGate firewalls worldwide — to the INC Ransom and Lynx ransomware-as-a-service operations. A single operator was found logged into the negotiation panels of both groups using infrastructure traceable to FortiBleed, with at least 12 ransomware deployments and over 110 million harvested credentials tied to the campaign.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1085
- **ID:** TL-2026-1085
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** FortiBleed operator (Russia)
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

FortiBleed is a large-scale, financially motivated credential-harvesting operation active since at least February 2026 that abuses a legitimate FortiOS diagnostic feature — the `diagnose sniffer packet` command — via a custom Golang tool dubbed FortigateSniffer (also referenced as FortiGate Sniffer) to passively capture authentication traffic traversing compromised FortiGate firewalls. No FortiOS vulnerability or zero-day is required for initial compromise: threat actors gain access to devices through mass scanning (Masscan, Shodan, and a custom FortiProbe-fast filtering binary), SSH brute-forcing with FortiGate-specific wordlists, and SSL-VPN credential stuffing/dictionary attacks via a tool referred to as "forticheck." Once administrative access is obtained, the operators deploy FortigateSniffer to passively intercept authentication material across roughly two dozen protocols (Kerberos, NTLM, RADIUS, RDP, LDAP, TACACS+, RPC, SMB, SMTP, FTP, Telnet, WinRM, MS-SQL, MySQL, PostgreSQL) without dropping traditional malware, evading many endpoint-based detections.

SOCRadar's STRU discovered a persistent backdoor account (username "adminin", credential pair adminin:ITAdmin@888) planted on thousands of compromised devices — found on 3,947 distinct devices in a validated-credentials cache, including 1,562 instances in a single EU-focused batch — indicating provisioned rather than organically reused accounts. Harvested credentials (110+ million records, including 14.8M RADIUS, 924K NTLM hashes, 130K Kerberos hashes, and 89M MySQL authentication tokens) are processed through a Go-based ELF credential-extraction tool called CyberStrike Harvester v1.5, and password hashes are cracked at scale using Hashcat orchestrated through Hashtopolis against rented vast.ai GPU capacity, coordinated by a Telegram bot named HASHBOT. Operational tradecraft indicates a disciplined, professionalized crew: activity is geofenced and restricted to 07:00-18:00 Moscow time to blend with legitimate business traffic, tooling contains Cyrillic-language code comments suggesting Russian-speaking operators, and infrastructure is segmented across four subnet blocks hosted on Eastern European micro-hosting providers dedicated respectively to C2 aggregation, credential validation, sniffer deployment, and proxy rotation. Investigators also found a pentest-lab-style back-end (seven Kali Linux VMs under QEMU/KVM, hardened iptables, shared tmux sessions for multi-operator access) supporting an estimated 20-person team with defined roles.

The campaign has targeted more than 430,000 FortiGate devices across 150+ countries, with roughly 11,250 FortiGate portals actively scanned, admin-level access confirmed on 409 targets, and full domain compromise achieved on 354 of those — with traffic sniffers actively running on approximately 19,000 devices at peak (reduced to roughly 11,000 following vendor/CERT notifications). Between May 19 and June 15, 2026, at least 659 distinct credential-harvesting pipelines were launched. Post-compromise, operators pivot from firewall/VPN credential theft to Active Directory lateral movement, Kerberos hash cracking, and DFS backup exfiltration; SOCRadar also assesses the group may have exploited a previously undisclosed Nextcloud zero-day to expand access after initial compromise, though full technical details of that vulnerability have not been publicly released. A confirmed victim includes a NATO-aligned defense contractor, where exfiltration of DFS backup data began within minutes of an offline Kerberos hash crack completing. Victimology skews toward SMBs (66% under 200 employees, 90% under $100M revenue) concentrated in India, the United States, and Taiwan (~33% combined), with IT/MSP services as a primary target sector — likely valued for downstream access to MSP customer networks — alongside healthcare, education, and government targets identified via ransomware-panel overlap.

The pivotal escalation documented in this research: SOCRadar's STRU, while investigating a Windows staging server used by the FortiBleed operators (containing downloaded FortiGate configuration files, harvested credentials, and password-cracking infrastructure), found the same operator actively logged into the ransomware negotiation/victim-management panels of both the INC Ransom and Lynx ransomware-as-a-service platforms — the first documented direct link tying mass Fortinet credential harvesting to an active ransomware deployment pipeline. Victim data harvested during FortiBleed operations overlaps with organizations later listed on the INC ransomware leak site. INC Ransom has operated as a RaaS platform since mid-2023; Lynx, believed to be an INC rebrand or close affiliate, emerged roughly a year later in mid-2024. SOCRadar attributes at least 12 confirmed ransomware deployments and 354 completed FortiGate intrusions to access obtained through FortiBleed, with hundreds of endpoints encrypted across affected victim organizations.

## MITRE ATT&CK

- T1595 Active Scanning
- T1587 Develop Capabilities
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1078 Valid Accounts
- T1133 External Remote Services
- T1190 Exploit Public-Facing Application
- T1110 Brute Force
- T1040 Network Sniffing
- T1552 Unsecured Credentials
- T1003 OS Credential Dumping
- T1558 Steal or Forge Kerberos Tickets
- T1136 Create Account
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1036 Masquerading
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1046 Network Service Discovery
- T1087 Account Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1039 Data from Network Shared Drive
- T1119 Automated Collection
- T1071 Application Layer Protocol
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact

## Sources

- [FortiBleed credential-theft campaign linked to Lynx ransomware](https://www.bleepingcomputer.com/news/security/fortibleed-credential-theft-campaign-linked-to-lynx-ransomware/)
- [SOCRadar Links FortiBleed Campaign to INC and Lynx Ransomware Operations](https://socradar.io/blog/fortibleed-inc-lynx-ransomware-link/)
- [FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations](https://thehackernews.com/2026/07/fortibleed-credential-theft-linked-to.html)
- [FortiBleed Credential Theft Campaign Linked to Lynx Ransomware](https://securityboulevard.com/2026/07/fortibleed-credential-theft-campaign-linked-to-lynx-ransomware/)
- [430,000 FortiGate Devices Exposed in FortiBleed Ransomware Link](https://securityaffairs.com/194645/security/430000-fortigate-devices-exposed-in-fortibleed-ransomware-link.html)
- [FortiBleed Confirmed as Ransomware Pipeline: INC and Lynx Linked to 430,000 Firewalls](https://www.techtimes.com/articles/319509/20260702/fortibleed-confirmed-ransomware-pipeline-inc-lynx-linked-430000-firewalls.htm)
- [FortiBleed linked to ransomware groups INC and Lynx](https://www.techzine.eu/news/security/142639/fortibleed-linked-to-ransomware-groups-inc-and-lynx/)
- [FortiBleed Campaign Linked to INC, Lynx Ransomware Attacks](https://www.securityweek.com/fortibleed-campaign-linked-to-inc-lynx-ransomware-attacks/)
- [FortiBleed campaign used custom FortiGate sniffer to steal credentials](https://www.bleepingcomputer.com/news/security/fortibleed-campaign-used-custom-fortigate-sniffer-to-steal-credentials/)
- [FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation](https://thehackernews.com/2026/06/fortibleed-targeted-fortigate-firewalls.html)
- [FortiBleed: The Most Detailed Breakdown Yet of an Active Russian Credential-Harvesting Operation](https://securityaffairs.com/194004/hacking/fortibleed-the-most-detailed-breakdown-yet-of-an-active-russian-credential-harvesting-operation.html)
- [Inside FortiBleed: Reverse Engineering the CyberStrike Harvester Behind a Global FortiGate Credential Factory](https://arcticwolf.com/resources/blog/inside-fortibleed-reverse-engineering-the-cyberstrike-harvester-behind-a-global-fortigate-credential-factory/)
- [More Than a Leak: What SpyCloud Found Inside the FortiBleed Threat Actor Infrastructure](https://spycloud.com/blog/what-spycloud-found-inside-the-fortibleed-threat-actor-infrastructure/)
- [FortiBleed campaign traced to INC and Lynx ransomware operations](https://www.cybersecuritydive.com/news/fortibleed-campaign-traced-to-inc-and-lynx-ransomware-operations/824348/)
- [What Is FortiBleed? Fortinet Credential Theft Campaign Explained](https://socradar.io/blog/what-is-fortibleed/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1085