Threat reportRansomwareTL-2026-1090
FortiBleed Credential-Harvesting Campaign Against 430,000 FortiGate Firewalls Feeds INC Ransom and Lynx Ransomware Operations
FortiBleed Credential-Harvesting Campaign Against 430,000 (TL-2026-1090), also tracked as FortiBleed, is a critical-severity ransomware operation, first published 2026-07-02. It is attributed to FortiBleed IAB Crew with medium confidence, affects Fortinet FortiGate (FortiOS), references 2 CVEs (CVE-2026-35616, CVE-2023-3519), maps to 33 MITRE ATT&CK techniques (T1021.001, T1036.005, T1040), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 33MITRE ATT&CK
- Actors
- 1FortiBleed IAB Crew
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-1090
- Threat ID
- TL-2026-1090
- Also known as
- FortiBleed, FortiGate Sniffer Campaign
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- FortiBleed IAB Crew
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, technology, logistics, industrial, health, education, government administration, critical infrastructure
- Target regions
- Latin America, Asia Pacific, North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in FortiBleed Credential-Harvesting Campaign Against 430,000
Malware and tooling: FortigateSniffer, INC Ransomware - S1139, Lynx Ransomware, 7-Zip / WinRAR, MEGAsync
How FortiBleed Credential-Harvesting Campaign Against 430,000 works
SOCRadar's FortiBleed investigation links a mass credential-harvesting campaign against 430,000+ FortiGate firewalls worldwide to active ransomware deployments, after an operator was found logged into the negotiation panels of both INC Ransom and Lynx. Admin-level access was confirmed on 409 targets with full attack-chain compromise (VPN to domain controller to domain admin) on 354, and the harvested access has been tied to at least 12 ransomware deployments with hundreds of encrypted endpoints.
FortiBleed is a large-scale credential-harvesting operation, publicly documented by SOCRadar on 2026-07-01, that targeted more than 430,000 internet-facing FortiGate firewalls across 150+ countries. The operators scanned roughly 11,250-11,000 FortiGate management portals, attempted brute-force logins with known/leaked credential combinations, and — where initial access was gained — deployed a custom Golang packet-sniffing tool (publicly referred to as 'FortigateSniffer' / 'FortiGate Sniffer') that abuses FortiOS's native `diagnose sniffer packet` CLI command to passively intercept authentication traffic across roughly two dozen network protocols. The sniffer was installed on an estimated 12,000-19,000 devices, and more than 110 million credentials are reported to have been harvested in total. Investigators also recovered a persistent backdoor account with the username 'adminin' used to maintain access on compromised firewalls, and evidence that the operators possess an undisclosed zero-day vulnerability in Nextcloud that is under active exploitation-in-development. Of the compromised firewalls, 409 yielded confirmed admin-level access and 354 were pushed through a full attack chain: VPN compromise, pivot to the internal domain controller, and escalation to domain admin. During a takedown/investigation of one FortiBleed staging server, SOCRadar found that an operator with FortiBleed infrastructure access was logged into the ransomware negotiation panels of both INC Ransom and Lynx ransomware, directly engaging with active ransom negotiations. Cross-referencing showed overlap between organizations whose credentials were harvested by FortiBleed and organizations later listed on the INC Ransom leak site, and researchers estimate ransomware deployment can follow initial credential theft within 30-60 days. At least 12 confirmed ransomware deployments and hundreds of encrypted endpoints have been attributed to the campaign so far. Lynx is assessed by multiple vendors (Unit 42, Picus, SOCRadar) as an evolved rebrand of INC Ransom rather than a wholly separate group, sharing a large portion of its codebase, AES-128-CTR + Curve25519 encryption scheme, and RaaS affiliate structure; INC/Lynx have historically gained initial access via exploitation of public-facing applications (e.g., CVE-2023-3519 in Citrix NetScaler) and spear-phishing, then used RDP and lateral tool transfer for lateral movement, 7-Zip/WinRAR staging, and Mega/cloud exfiltration ahead of double-extortion encryption (.inc / .lynx extensions). The FortiBleed operation itself is assessed as a Russian-speaking initial-access-broker (IAB) crew of roughly 20 personnel with defined roles — a small core of senior operators handling high-impact intrusions supported by specialists and junior staff — that discovered and monetized access by selling or directly feeding it into ransomware affiliates. SOCRadar identified over 200 additional operational servers (500 total) tied to the infrastructure beyond the original campaign, plus secondary reconnaissance against roughly 29,000 IPs and 37 domains associated with Citrix environments, and separately observed exploitation of CVE-2026-35616 (Fortinet FortiClient EMS, CVSS 9.1) tied to EKZ Stealer deployment in the same threat landscape. Primary targeted sectors include manufacturing, technology, and logistics, with a geographic skew toward Latin America and Asia-Pacific alongside the broader 150+-country scanning footprint. SOCRadar states full IOC disclosure and additional technical detail will follow in a forthcoming whitepaper; no CVE has yet been assigned to the FortiOS `diagnose sniffer packet` abuse technique itself.
MITRE ATT&CK techniques used in TL-2026-1090
Lateral Movement
T1021.001 Remote Desktop Protocol; T1570 Lateral Tool Transfer
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion
Credential Access
T1040 Network Sniffing; T1110 Brute Force; T1552 Unsecured Credentials; T1557 Adversary-in-the-Middle
Discovery
T1046 Network Service Discovery; T1049 System Network Connections Discovery; T1069.002 Domain Groups; T1087.002 Domain Account; T1135 Network Share Discovery
Execution
T1047 Windows Management Instrumentation; T1059.003 Windows Command Shell; T1569.002 Service Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1219 Remote Access Tools
Collection
T1074 Data Staged; T1560.001 Archive via Utility
Persistence
T1078 Valid Accounts; T1136.001 Local Account
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566 Phishing
Impact
T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1657 Financial Theft
Exfiltration
T1537 Transfer Data to Cloud Account
Resource Development
Reconnaissance
T1595.002 Vulnerability Scanning
defense-impairment
Affected products and versions in FortiBleed Credential-Harvesting Campaign Against 430,000
- Fortinet — FortiGate (FortiOS)
Vulnerable versions: internet-exposed FortiOS management/VPN portals, version unspecified in source
Fixed in: pending Fortinet advisory - Fortinet — FortiClient EMS
Vulnerable versions: versions affected by CVE-2026-35616
Fixed in: patched per Fortinet PSIRT advisory for CVE-2026-35616 - Nextcloud — Nextcloud Server
Vulnerable versions: undisclosed zero-day reportedly in attacker possession
Fixed in: none published - Citrix — NetScaler ADC/Gateway
Vulnerable versions: versions affected by CVE-2023-3519
Fixed in: per Citrix advisory for CVE-2023-3519
Remediation for FortiBleed Credential-Harvesting Campaign Against 430,000
Patches
- Apply Fortinet guidance for FortiOS hardening and monitor Fortinet PSIRT advisories for a forthcoming fix/advisory addressing diagnose sniffer packet abuse
- Patch FortiClient EMS against CVE-2026-35616 (CVSS 9.1)
- Monitor Nextcloud security advisories closely given reported undisclosed zero-day in attacker possession
Immediate actions
- Audit all FortiGate devices for unauthorized local admin accounts, especially the username 'adminin'
- Rotate all credentials (VPN, admin, domain) used on or synced through FortiGate firewalls exposed to the internet
- Review FortiOS configuration and logs for unexpected use of the 'diagnose sniffer packet' command or packet capture activity outside authorized maintenance windows
- Disable or restrict internet-facing FortiGate management/VPN portals where not operationally required; enforce MFA on all remaining exposed portals
- Hunt for anomalous outbound Golang-binary network traffic and unsigned executables on FortiGate appliances and adjacent jump hosts
- Review domain controller authentication logs for anomalous lateral movement following VPN logins from FortiGate-fronted networks
Workarounds
- Disable the FortiOS 'diagnose sniffer packet' CLI capability for non-administrative sessions where feasible
- Require just-in-time, logged, and reviewed use of any packet-capture CLI functionality on production firewalls
- Restrict FortiGate admin/VPN portal access via allow-listed source IPs
Longer-term hardening
- Segment FortiGate management interfaces away from the general internet and place behind an out-of-band management network
- Deploy EDR/NDR with behavioral detection tuned to ransomware precursor activity (lateral tool transfer, mass file staging, shadow copy deletion)
- Establish a 30-60 day incident response SLA for any confirmed credential compromise on perimeter devices, given the observed lag from credential theft to ransomware deployment
- Maintain an inventory of internet-facing Fortinet/Citrix/Nextcloud assets and prioritize patch/upgrade cycles for perimeter appliances
- Implement network segmentation limiting VPN-terminated sessions from directly reaching domain controllers
CVEs associated with FortiBleed Credential-Harvesting Campaign Against 430,000
Weaknesses (CWE) in FortiBleed Credential-Harvesting Campaign Against 430,000
Timeline of FortiBleed Credential-Harvesting Campaign Against 430,000
- INC Ransom RaaS operation launches and begins active operations, later linked as the predecessor to Lynx.
- INC Ransom affiliates observed exploiting CVE-2023-3519 in Citrix NetScaler ADC/Gateway for initial access in historical campaigns.
- Lynx ransomware emerges, assessed by multiple vendors as an evolved rebrand of INC Ransom sharing code, encryption scheme, and RaaS structure.
- SOCRadar discovers and begins investigating the FortiBleed mass credential-harvesting campaign against internet-facing FortiGate firewalls.
- Researchers scan roughly 11,250 FortiGate management portals across 150+ countries and identify a custom Golang packet-sniffing tool ('FortigateSniffer') abusing the FortiOS diagnose sniffer packet command on thousands of devices.
- Analysis of a FortiBleed staging/coordination server recovers internal target inventories, harvested credential data, automation scripts, and operational logs.
- Investigators find browser sessions on FortiBleed infrastructure logged into the ransomware negotiation panels of both INC Ransom and Lynx, directly tying the credential-harvesting operation to active ransom negotiations.
- Cross-referencing shows overlap between organizations whose credentials were harvested via FortiBleed and organizations later listed on the INC Ransom leak site.
- SOCRadar publishes the FortiBleed blog post publicly linking the campaign to INC Ransom and Lynx, reporting 409 targets with admin-level access, 354 with full attack-chain compromise, and 12+ confirmed ransomware deployments.
- SOCRadar states that complete IOCs, operator aliases, and additional tooling detail are withheld pending a forthcoming second whitepaper.
- Multiple outlets (BleepingComputer, The Hacker News, SecurityWeek, Security Affairs, CyberPress) republish and expand on the FortiBleed findings, adding details such as the 'adminin' backdoor account, 110+ million harvested credentials, and a suspected undisclosed Nextcloud zero-day.
Sources cited for FortiBleed Credential-Harvesting Campaign Against 430,000
- FortiBleed: INC Ransom and Lynx Ransomware Link
- FortiBleed Confirmed as Ransomware Pipeline: INC and Lynx Linked to 430,000 Firewalls
- FortiBleed credential-theft campaign linked to Lynx ransomware
- FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations
- FortiBleed Credential Theft Campaign Tied to INC and Lynx Ransomware Attacks
- FortiBleed Campaign Linked to INC, Lynx Ransomware Attacks
- 430,000 FortiGate Devices Exposed in FortiBleed Ransomware Link
- FortiBleed Password Stealing Attack Linked to INC and Lynx Ransomware Operations
- FortiBleed Credential Theft Campaign Linked to Lynx Ransomware
- FortiBleed Vulnerability Linked to INC Threat Group and Lynx Ransomware Attacks
- INC Ransom, GOLD IONIC, Group G1032
- INC Ransomware, Software S1139
- Dark Web Profile: INC Ransom
- Dark Web Profile: Lynx Ransomware
- Lynx Ransomware: A Rebranding of INC Ransomware
Detection coverage for TL-2026-1090
As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1090 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.