FortiBleed Credential Theft Campaign Linked to INC and Lynx Ransomware Operations

FortiBleed Credential Theft Campaign Linked to INC and Lynx (TL-2026-1118), also tracked as FortiBleed, is a critical-severity ransomware operation, first published 2026-07-05 and last reviewed 2026-09-08. It is attributed to FortiBleed Initial Access Broker (Russia) with medium confidence, affects Fortinet FortiGate / FortiOS (administrator credential hashing), references 5 CVEs (CVE-2026-35616, CVE-2026-24858, CVE-2024-21762), maps to 41 MITRE ATT&CK techniques (T1003, T1018, T1021), and is covered by 9 detection rules and 39 indicators of compromise.

Key facts for TL-2026-1118

Threat ID
TL-2026-1118
Also known as
FortiBleed, FortiGate Credential Factory, CyberStrike Harvester Campaign
Severity
CRITICAL
Status
ACTIVE
Category
RANSOMWARE
First published
2026-07-05
Last reviewed
2026-09-08
Attribution
FortiBleed Initial Access Broker
Attribution confidence
MEDIUM
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
itservices, government administration, defense, finance, health, manufacturing, telecoms, automotive, technology, managedserviceproviders
Target regions
Global, North America, Europe, Asia-Pacific, Middle East
Detection rules
9
Indicators of compromise
39
Updates
2026-09-08 · revalidated 1× · latest source

Malware and tooling in FortiBleed Credential Theft Campaign Linked to INC and Lynx

Malware and tooling: CyberStrike Harvester, EKZ Stealer, Hashcat / Hashtopolis, Impacket - S0357, forticheck, mpbrute2.bin, openfortivpn

A financially motivated, Russian-speaking initial access broker operation dubbed FortiBleed has harvested over 110 million credentials from roughly 430,000 targeted FortiGate firewalls since February 2026 using a Golang-based packet sniffer known as CyberStrike Harvester (FortigateSniffer). SOCRadar found an operator with access to the FortiBleed infrastructure also logged into both the INC Ransom and Lynx ransomware negotiation panels, tying the mass credential theft directly to at least 12 confirmed ransomware deployments.

How FortiBleed Credential Theft Campaign Linked to INC and Lynx works

FortiBleed is a large-scale, ongoing credential-compromise campaign against internet-facing Fortinet FortiGate firewalls and SSL-VPN gateways, active since at least February 2026 and traced back to reconnaissance/brute-force activity as early as January 11, 2026. The operation is run by a Russian-speaking, financially motivated initial access broker (IAB) — tooling recovered from the actors' infrastructure contains Cyrillic-language code comments and was hosted across a network of loosely regulated Eastern European micro-hosting providers. The campaign does not rely on a single novel remote-code-execution vulnerability; instead it chains credential stuffing, password spraying, FortiGate configuration-file harvesting, offline hash cracking, and passive post-authentication traffic capture into a repeatable 'credential factory'.

The core tool is a Go-based ELF/PE binary that identifies itself internally as CyberStrike Harvester v1.5 (also reported publicly under the name FortigateSniffer or fg_sniffer). Once deployed to a compromised FortiGate appliance, it abuses the device's own built-in diagnostic command `diagnose sniffer packet` to passively capture authentication traffic traversing the firewall across roughly two dozen protocols, including RADIUS, NTLM, Kerberos, LDAP, RDP, SMB, MSSQL, FTP, Telnet, and WinRM. Captured traffic is converted to `.pcapng` via an internal 'SNIFTRAN' engine and parsed for cleartext passwords, NTLMv2 hashes, Kerberos TGS/AS-REP tickets, and session cookies. Sniffing windows are restricted by GeoIP-based filtering (an `ipgeo.csv` reference dataset) to 07:00–18:00 Moscow time, consistent with an operator working shift pattern. Companion tools `mpbrute2.bin` (SSH brute-forcing using 16 product-specific wordlists, ~90% validation success across 6,127 devices) and `forticheck` (up to 25,000-thread SSL-VPN portal brute-forcing) round out the credential-acquisition pipeline; a 237,330-entry dump of validated FortiGate SSH credentials (`ssh.txt`) was recovered from operator infrastructure.

The technical root cause enabling mass credential exposure is Fortinet's historical use of legacy SHA-256 hashing for locally stored administrator credentials. FortiOS 7.2.11, 7.4.8, and 7.6.1 introduced PBKDF2-based hashing, but administrators who upgraded without subsequently logging in retained the weaker legacy hash, leaving those credentials crackable offline via the operators' Hashcat/Hashtopolis cracking farm. Separately, the FortiBleed ecosystem is linked to active exploitation of several Fortinet CVEs used for initial network access and follow-on credential theft: the historic FortiOS SSL-VPN pre-auth/heap-overflow chain (CVE-2022-42475, CVE-2023-27997, CVE-2024-21762), the January 2026 FortiCloud SSO authentication-bypass zero-day (CVE-2026-24858, CISA KEV-listed 2026-01-27), and the CISA KEV-listed FortiClient EMS improper-access-control flaw (CVE-2026-35616, added 2026-04-06) that was used from May 2026 onward to push the EKZ Stealer — a Chromium/Firefox credential- and cookie-stealing infostealer — disguised as a legitimate Fortinet endpoint update executed via PowerShell.

Where harvested credentials granted network access, operators pivoted using `openfortivpn` tunnels and Impacket-based tooling to enumerate Active Directory, validate Kerberos tickets, authenticate over SMB, check administrative shares, and collect data from SMB/DFS shares. In at least one confirmed case, a Turkish NATO-aligned defense contractor had DFS backup data exfiltrated within minutes of Kerberos hashes being cracked offline. A persistent backdoor local account named 'adminin' was observed created on compromised systems. Scanning activity was tracked against roughly 11,250 FortiGate portals across 150+ countries (later analysis broadened this to 194 countries and 21,000+ unique domains), with confirmed admin-level access on 409 targets and full domain compromise (VPN + domain-controller + domain-admin access) achieved on 354 of them.

The campaign was exposed by an operational security failure: security researcher Volodymyr Diachenko discovered an exposed threat-actor server hosting the stolen credential dataset and attack tooling on June 13, 2026; Sophos MDR had independently observed configuration-file exfiltration to an external IP as early as June 2, 2026. Public disclosure followed on June 16, 2026 via independent SOCRadar and Arctic Wolf analysis, prompting a CISA alert on June 18, 2026 urging Fortinet customers to terminate active sessions, reset credentials, enforce MFA, and remove management interfaces from public exposure. A subsequent SOCRadar investigation (published July 1–2, 2026) recovered an internal tracking document describing an organized ~20-person operation with a tiered division of labor, and found — via one of roughly 200 newly discovered operator servers — browser sessions in which a FortiBleed operator was actively logged into the negotiation/victim-chat panels of both the INC Ransom and Lynx ransomware operations. Victim data harvested via FortiBleed infrastructure directly overlapped with a separately discovered INC Ransom open directory, and at least 12 confirmed ransomware deployments (encrypting hundreds of endpoints across affected organizations) have been traced to FortiBleed-derived access. Lynx is independently assessed by MITRE ATT&CK-aligned researchers to be an evolved rebrand/derivative of INC Ransom (MITRE ATT&CK group G1032, aka GOLD IONIC), reusing significant portions of INC's ransomware source code. Confirmed and reported victim organizations span nearly every major sector and geography, including Foxconn, Samsung, Comcast, Siemens, Lenovo, FedEx, Accenture, Oracle, Chevron, AT&T, Mercedes-Benz, and Toyota; roughly 66% of affected organizations have fewer than 200 employees, and IT/managed-service-provider organizations are disproportionately targeted as a pivot point into downstream customer environments.

MITRE ATT&CK techniques used in TL-2026-1118

Credential Access

T1003 OS Credential Dumping; T1040 Network Sniffing; T1110 Brute Force; T1552 Unsecured Credentials; T1555 Credentials from Password Stores; T1558 Steal or Forge Kerberos Tickets

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery; T1082 System Information Discovery; T1087 Account Discovery

Lateral Movement

T1021 Remote Services; T1550 Use Alternate Authentication Material

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1562 Impair Defenses

Collection

T1039 Data from Network Shared Drive

Exfiltration

T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts

Command and Control

T1071 Application Layer Protocol; T1572 Protocol Tunneling

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Persistence

T1098 Account Manipulation; T1136 Create Account

Impact

T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1657 Financial Theft

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1589 Gather Victim Identity Information; T1592 Gather Victim Host Information; T1595 Active Scanning

defense-impairment

T1600 Weaken Encryption

Affected products and versions in FortiBleed Credential Theft Campaign Linked to INC and Lynx

  • Fortinet — FortiGate / FortiOS (administrator credential hashing)
    Vulnerable versions: FortiOS releases prior to 7.2.11; prior to 7.4.8; prior to 7.6.1 (legacy SHA-256 admin credential hashing retained until re-login)
    Fixed in: FortiOS 7.2.11+; 7.4.8+; 7.6.1+ with PBKDF2 hashing (requires administrator re-login to complete migration)
  • Fortinet — FortiOS / FortiProxy SSL-VPN
    Vulnerable versions: FortiOS < 7.0.17; < 7.2.11; < 7.4.7; < 7.6.2 (CVE-2024-21762); versions affected by CVE-2023-27997 and CVE-2022-42475
    Fixed in: FortiOS 7.6.2; 7.4.7; 7.2.11; 7.0.17; 6.4.16
  • Fortinet — FortiClient EMS
    Vulnerable versions: 7.4.5; 7.4.6
    Fixed in: Fortinet-issued patch addressing CVE-2026-35616 (disclosed after in-the-wild exploitation reported March 31, 2026)
  • Fortinet — FortiOS / FortiManager / FortiAnalyzer / FortiProxy / FortiWeb (FortiCloud SSO)
    Vulnerable versions: devices with FortiCloud SSO authentication enabled prior to patch
    Fixed in: FortiOS 7.4.11+ and corresponding patched branches for CVE-2026-24858

Remediation for FortiBleed Credential Theft Campaign Linked to INC and Lynx

Patches

  • Apply the Fortinet patch for CVE-2026-35616 (FortiClient EMS improper access control / EKZ Stealer delivery vector)
  • Apply the Fortinet patch for CVE-2026-24858 (FortiOS/FortiManager/FortiAnalyzer/FortiProxy/FortiWeb FortiCloud SSO authentication bypass) — upgrade to FortiOS 7.4.11+ or the corresponding fixed branch
  • Apply the Fortinet patch for CVE-2024-21762 (FortiOS SSL-VPN out-of-bounds write) — upgrade to 7.6.2, 7.4.7, 7.2.11, 7.0.17, or 6.4.16
  • Apply the Fortinet patch for CVE-2023-27997 (FortiOS/FortiProxy SSL-VPN pre-auth heap overflow)
  • Apply the Fortinet patch for CVE-2022-42475 (FortiOS SSL-VPN heap buffer overflow)

Immediate actions

  • Terminate all active SSL-VPN and administrative sessions on FortiGate devices per CISA guidance
  • Reset all Fortinet VPN and administrative passwords, especially on internet-facing devices
  • Remove FortiGate management interfaces (HTTP/HTTPS admin, SSH) from public internet exposure; restrict to trusted internal networks
  • Audit for and remove unauthorized local admin accounts, including the observed 'adminin' backdoor account
  • Upgrade to FortiOS 7.2.11, 7.4.8, or 7.6.1+ and require every local administrator to log in post-upgrade to complete the PBKDF2 credential re-hash migration

Workarounds

  • Disable FortiCloud SSO authentication on internet-facing devices until patched against CVE-2026-24858
  • Enforce IP allow-listing for FortiGate administrative and SSL-VPN portals where a management upgrade cannot be immediately performed
  • Rotate LDAP/Active Directory service-account credentials connected to FortiGate devices and treat any device with signs of compromise as fully breached

Longer-term hardening

  • Enforce phishing-resistant MFA on all administrative and remote-access interfaces
  • Deploy EDR/NDR detections tuned for openfortivpn tunnel abuse, Impacket-based AD enumeration, and Kerberoasting/AS-REP roasting activity
  • Implement network segmentation to limit lateral movement from a compromised perimeter appliance into the internal domain
  • Establish continuous dark-web/leak monitoring for organizational credentials tied to internet-facing Fortinet infrastructure
  • Run tabletop exercises simulating ransomware deployment following perimeter credential compromise, given the confirmed FortiBleed-to-INC/Lynx pipeline

CVEs associated with FortiBleed Credential Theft Campaign Linked to INC and Lynx

CVE-2026-35616, CVE-2026-24858, CVE-2024-21762, CVE-2023-27997, CVE-2022-42475

Weaknesses (CWE) in FortiBleed Credential Theft Campaign Linked to INC and Lynx

CWE-287, CWE-288, CWE-522, CWE-306, CWE-798, CWE-787, CWE-122

Timeline of FortiBleed Credential Theft Campaign Linked to INC and Lynx

Showing the 20 most recent tracked events.

  • Fortinet releases FortiOS 7.4.11 and guidance addressing CVE-2026-24858; CISA publishes accompanying alert.
  • The FortiBleed credential-harvesting campaign begins sustained operations, per SOCRadar's assessed start date of February 2026.
  • Large-scale SSL-VPN portal enumeration completed: 247,584 unique FortiGate IPs identified across 194 countries using Masscan, Shodan, and a custom FortiProbe-fast scanner.
  • RDWeb portal enumeration completed: 73,889 login URLs catalogued for follow-on credential stuffing.
  • CVE-2026-35616 (FortiClient EMS improper access control) is reported to Fortinet after being observed exploited in the wild.
  • MSSQL credential checker campaign begins from operator IP 193.8.187.42, running high-volume credential validation against discovered targets.
  • FortigateSniffer (fg_sniffer) deployed on compromised FortiGate devices, with capture cycles initiated from 193.8.187.26 using 'diagnose sniffer packet' targeting 24 protocols.
  • Arctic Wolf observes a cluster of activity in which CVE-2026-35616 is exploited against FortiClient EMS to deliver the EKZ Stealer disguised as a legitimate Fortinet patch.
  • 659 harvest cycles begin across compromised FortiGates (through June 15), collecting ~14.8M records including 924K RADIUS hashes, 130K Kerberos hashes, and ~89M total authentication tokens.
  • Sophos MDR records its earliest confirmed sighting of FortiBleed-related abuse: a detected export of a FortiGate configuration file to an external IP address.
  • Security researcher Volodymyr Diachenko discovers an exposed threat-actor server hosting the stolen FortiBleed credential dataset alongside attack tooling.
  • SSL-VPN credential-stuffing campaign produces 7,187 valid VPN sessions, providing authenticated access into victim internal networks.
  • FortiBleed is formally disclosed to the public following independent analysis by SOCRadar and Arctic Wolf of the exposed operator infrastructure.
  • CISA issues an alert urging Fortinet customers to terminate active sessions, reset credentials, enforce MFA, and remove management interfaces from public exposure in response to FortiBleed.
  • Cloud Security Alliance publishes a research note on FortiBleed finding 63% of compromised accounts were default/generic admin accounts (35% generic admin, 28.3% built-in Fortinet system accounts).
  • Analysis confirms targeted exfiltration of DFS backup data from a Turkish NATO-aligned defense contractor, triggered within minutes of Kerberos hashes being cracked offline using FortiBleed-harvested material.
  • Fortinet publishes an official response characterizing FortiBleed as a credential-stuffing campaign enabled by weak password hygiene and lack of MFA rather than a new vulnerability, recommending PBKDF2 hashing and the 'login-lockout-upon-weaker-encryption' setting.
  • SOCRadar publishes findings that a FortiBleed operator was found logged into both the INC Ransom and Lynx ransomware negotiation panels, with victim data overlapping between FortiBleed infrastructure and an INC Ransom open directory.
  • The Hacker News and other outlets report the FortiBleed-to-INC/Lynx ransomware linkage, documenting at least 12 confirmed ransomware deployments traced to FortiBleed-derived access.
  • Bitdefender publishes its Threat Debrief detailing MDR observations of the FortiBleed campaign.

Update history for TL-2026-1118

  • 2026-09-08: What changed No field escalations applied. The exploitability (ACTIVE) and status (ACTIVE) are unchanged and consistent between reports. New indicators (14) 6 new operator/infrastructure IPs (1 credential-harvesting node, 5 Hashtopolis GPU

Sources cited for FortiBleed Credential Theft Campaign Linked to INC and Lynx

Threats related to FortiBleed Credential Theft Campaign Linked to INC and Lynx

Detection coverage for TL-2026-1118

As of 2026-09-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1118 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1118

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats