# FortiBleed Credential-Harvesting Campaign Against 430,000 FortiGate Firewalls Feeds INC Ransom and Lynx Ransomware Operations

> SOCRadar's FortiBleed investigation links a mass credential-harvesting campaign against 430,000+ FortiGate firewalls worldwide to active ransomware deployments, after an operator was found logged into the negotiation panels of both INC Ransom and Lynx. Admin-level access was confirmed on 409 targets with full attack-chain compromise (VPN to domain controller to domain admin) on 354, and the harvested access has been tied to at least 12 ransomware deployments with hundreds of encrypted endpoints.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1090
- **ID:** TL-2026-1090
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** FortiBleed IAB Crew
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-35616, CVE-2023-3519

## Description

FortiBleed is a large-scale credential-harvesting operation, publicly documented by SOCRadar on 2026-07-01, that targeted more than 430,000 internet-facing FortiGate firewalls across 150+ countries. The operators scanned roughly 11,250-11,000 FortiGate management portals, attempted brute-force logins with known/leaked credential combinations, and — where initial access was gained — deployed a custom Golang packet-sniffing tool (publicly referred to as 'FortigateSniffer' / 'FortiGate Sniffer') that abuses FortiOS's native `diagnose sniffer packet` CLI command to passively intercept authentication traffic across roughly two dozen network protocols. The sniffer was installed on an estimated 12,000-19,000 devices, and more than 110 million credentials are reported to have been harvested in total. Investigators also recovered a persistent backdoor account with the username 'adminin' used to maintain access on compromised firewalls, and evidence that the operators possess an undisclosed zero-day vulnerability in Nextcloud that is under active exploitation-in-development. Of the compromised firewalls, 409 yielded confirmed admin-level access and 354 were pushed through a full attack chain: VPN compromise, pivot to the internal domain controller, and escalation to domain admin. During a takedown/investigation of one FortiBleed staging server, SOCRadar found that an operator with FortiBleed infrastructure access was logged into the ransomware negotiation panels of both INC Ransom and Lynx ransomware, directly engaging with active ransom negotiations. Cross-referencing showed overlap between organizations whose credentials were harvested by FortiBleed and organizations later listed on the INC Ransom leak site, and researchers estimate ransomware deployment can follow initial credential theft within 30-60 days. At least 12 confirmed ransomware deployments and hundreds of encrypted endpoints have been attributed to the campaign so far. Lynx is assessed by multiple vendors (Unit 42, Picus, SOCRadar) as an evolved rebrand of INC Ransom rather than a wholly separate group, sharing a large portion of its codebase, AES-128-CTR + Curve25519 encryption scheme, and RaaS affiliate structure; INC/Lynx have historically gained initial access via exploitation of public-facing applications (e.g., CVE-2023-3519 in Citrix NetScaler) and spear-phishing, then used RDP and lateral tool transfer for lateral movement, 7-Zip/WinRAR staging, and Mega/cloud exfiltration ahead of double-extortion encryption (.inc / .lynx extensions). The FortiBleed operation itself is assessed as a Russian-speaking initial-access-broker (IAB) crew of roughly 20 personnel with defined roles — a small core of senior operators handling high-impact intrusions supported by specialists and junior staff — that discovered and monetized access by selling or directly feeding it into ransomware affiliates. SOCRadar identified over 200 additional operational servers (500 total) tied to the infrastructure beyond the original campaign, plus secondary reconnaissance against roughly 29,000 IPs and 37 domains associated with Citrix environments, and separately observed exploitation of CVE-2026-35616 (Fortinet FortiClient EMS, CVSS 9.1) tied to EKZ Stealer deployment in the same threat landscape. Primary targeted sectors include manufacturing, technology, and logistics, with a geographic skew toward Latin America and Asia-Pacific alongside the broader 150+-country scanning footprint. SOCRadar states full IOC disclosure and additional technical detail will follow in a forthcoming whitepaper; no CVE has yet been assigned to the FortiOS `diagnose sniffer packet` abuse technique itself.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1133 External Remote Services
- T1110 Brute Force
- T1557 Adversary-in-the-Middle
- T1040 Network Sniffing
- T1552 Unsecured Credentials
- T1136.001 Local Account
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1070.004 File Deletion
- T1036.005 Match Legitimate Resource Name or Location
- T1087.002 Domain Account
- T1046 Network Service Discovery
- T1135 Network Share Discovery
- T1069.002 Domain Groups
- T1049 System Network Connections Discovery
- T1021.001 Remote Desktop Protocol
- T1570 Lateral Tool Transfer
- T1074 Data Staged
- T1560.001 Archive via Utility
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1537 Transfer Data to Cloud Account
- T1059.003 Windows Command Shell
- T1569.002 Service Execution
- T1047 Windows Management Instrumentation
- T1486 Data Encrypted for Impact
- T1657 Financial Theft
- T1490 Inhibit System Recovery
- T1588.002 Tool
- T1595.002 Vulnerability Scanning

## Sources

- [FortiBleed: INC Ransom and Lynx Ransomware Link](https://socradar.io/blog/fortibleed-inc-lynx-ransomware-link/)
- [FortiBleed Confirmed as Ransomware Pipeline: INC and Lynx Linked to 430,000 Firewalls](https://www.techtimes.com/articles/319509/20260702/fortibleed-confirmed-ransomware-pipeline-inc-lynx-linked-430000-firewalls.htm)
- [FortiBleed credential-theft campaign linked to Lynx ransomware](https://www.bleepingcomputer.com/news/security/fortibleed-credential-theft-campaign-linked-to-lynx-ransomware/)
- [FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations](https://thehackernews.com/2026/07/fortibleed-credential-theft-linked-to.html)
- [FortiBleed Credential Theft Campaign Tied to INC and Lynx Ransomware Attacks](https://cyberpress.org/fortibleed-credential-theft-campaign/)
- [FortiBleed Campaign Linked to INC, Lynx Ransomware Attacks](https://www.securityweek.com/fortibleed-campaign-linked-to-inc-lynx-ransomware-attacks/)
- [430,000 FortiGate Devices Exposed in FortiBleed Ransomware Link](https://securityaffairs.com/194645/security/430000-fortigate-devices-exposed-in-fortibleed-ransomware-link.html)
- [FortiBleed Password Stealing Attack Linked to INC and Lynx Ransomware Operations](https://cybersecuritynews.com/fortibleed-password-stealing-attack/)
- [FortiBleed Credential Theft Campaign Linked to Lynx Ransomware](https://securityboulevard.com/2026/07/fortibleed-credential-theft-campaign-linked-to-lynx-ransomware/)
- [FortiBleed Vulnerability Linked to INC Threat Group and Lynx Ransomware Attacks](https://www.news4hackers.com/fortibleed-vulnerability-linked-to-inc-threat-group-and-lynx-ransomware-attacks/)
- [INC Ransom, GOLD IONIC, Group G1032](https://attack.mitre.org/groups/G1032/)
- [INC Ransomware, Software S1139](https://attack.mitre.org/software/S1139/)
- [Dark Web Profile: INC Ransom](https://socradar.io/blog/dark-web-profile-inc-ransom/)
- [Dark Web Profile: Lynx Ransomware](https://socradar.io/blog/dark-web-profile-lynx-ransomware/)
- [Lynx Ransomware: A Rebranding of INC Ransomware](https://unit42.paloaltonetworks.com/inc-ransomware-rebrand-to-lynx/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1090