# FortiBleed Credential Theft Campaign Linked to INC and Lynx Ransomware Operations

> A financially motivated, Russian-speaking initial access broker operation dubbed FortiBleed has harvested over 110 million credentials from roughly 430,000 targeted FortiGate firewalls since February 2026 using a Golang-based packet sniffer known as CyberStrike Harvester (FortigateSniffer). SOCRadar found an operator with access to the FortiBleed infrastructure also logged into both the INC Ransom and Lynx ransomware negotiation panels, tying the mass credential theft directly to at least 12 confirmed ransomware deployments.

- **Published:** 2026-07-05T00:00:00Z
- **Last reviewed:** 2026-09-08T13:24:46.718Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1118
- **ID:** TL-2026-1118
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** FortiBleed Initial Access Broker (Russia)
- **Detections:** 9 · **IOCs:** 39 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-35616, CVE-2026-24858, CVE-2024-21762, CVE-2023-27997, CVE-2022-42475

## Description

FortiBleed is a large-scale, ongoing credential-compromise campaign against internet-facing Fortinet FortiGate firewalls and SSL-VPN gateways, active since at least February 2026 and traced back to reconnaissance/brute-force activity as early as January 11, 2026. The operation is run by a Russian-speaking, financially motivated initial access broker (IAB) — tooling recovered from the actors' infrastructure contains Cyrillic-language code comments and was hosted across a network of loosely regulated Eastern European micro-hosting providers. The campaign does not rely on a single novel remote-code-execution vulnerability; instead it chains credential stuffing, password spraying, FortiGate configuration-file harvesting, offline hash cracking, and passive post-authentication traffic capture into a repeatable 'credential factory'.

The core tool is a Go-based ELF/PE binary that identifies itself internally as CyberStrike Harvester v1.5 (also reported publicly under the name FortigateSniffer or fg_sniffer). Once deployed to a compromised FortiGate appliance, it abuses the device's own built-in diagnostic command `diagnose sniffer packet` to passively capture authentication traffic traversing the firewall across roughly two dozen protocols, including RADIUS, NTLM, Kerberos, LDAP, RDP, SMB, MSSQL, FTP, Telnet, and WinRM. Captured traffic is converted to `.pcapng` via an internal 'SNIFTRAN' engine and parsed for cleartext passwords, NTLMv2 hashes, Kerberos TGS/AS-REP tickets, and session cookies. Sniffing windows are restricted by GeoIP-based filtering (an `ipgeo.csv` reference dataset) to 07:00–18:00 Moscow time, consistent with an operator working shift pattern. Companion tools `mpbrute2.bin` (SSH brute-forcing using 16 product-specific wordlists, ~90% validation success across 6,127 devices) and `forticheck` (up to 25,000-thread SSL-VPN portal brute-forcing) round out the credential-acquisition pipeline; a 237,330-entry dump of validated FortiGate SSH credentials (`ssh.txt`) was recovered from operator infrastructure.

The technical root cause enabling mass credential exposure is Fortinet's historical use of legacy SHA-256 hashing for locally stored administrator credentials. FortiOS 7.2.11, 7.4.8, and 7.6.1 introduced PBKDF2-based hashing, but administrators who upgraded without subsequently logging in retained the weaker legacy hash, leaving those credentials crackable offline via the operators' Hashcat/Hashtopolis cracking farm. Separately, the FortiBleed ecosystem is linked to active exploitation of several Fortinet CVEs used for initial network access and follow-on credential theft: the historic FortiOS SSL-VPN pre-auth/heap-overflow chain (CVE-2022-42475, CVE-2023-27997, CVE-2024-21762), the January 2026 FortiCloud SSO authentication-bypass zero-day (CVE-2026-24858, CISA KEV-listed 2026-01-27), and the CISA KEV-listed FortiClient EMS improper-access-control flaw (CVE-2026-35616, added 2026-04-06) that was used from May 2026 onward to push the EKZ Stealer — a Chromium/Firefox credential- and cookie-stealing infostealer — disguised as a legitimate Fortinet endpoint update executed via PowerShell.

Where harvested credentials granted network access, operators pivoted using `openfortivpn` tunnels and Impacket-based tooling to enumerate Active Directory, validate Kerberos tickets, authenticate over SMB, check administrative shares, and collect data from SMB/DFS shares. In at least one confirmed case, a Turkish NATO-aligned defense contractor had DFS backup data exfiltrated within minutes of Kerberos hashes being cracked offline. A persistent backdoor local account named 'adminin' was observed created on compromised systems. Scanning activity was tracked against roughly 11,250 FortiGate portals across 150+ countries (later analysis broadened this to 194 countries and 21,000+ unique domains), with confirmed admin-level access on 409 targets and full domain compromise (VPN + domain-controller + domain-admin access) achieved on 354 of them.

The campaign was exposed by an operational security failure: security researcher Volodymyr Diachenko discovered an exposed threat-actor server hosting the stolen credential dataset and attack tooling on June 13, 2026; Sophos MDR had independently observed configuration-file exfiltration to an external IP as early as June 2, 2026. Public disclosure followed on June 16, 2026 via independent SOCRadar and Arctic Wolf analysis, prompting a CISA alert on June 18, 2026 urging Fortinet customers to terminate active sessions, reset credentials, enforce MFA, and remove management interfaces from public exposure. A subsequent SOCRadar investigation (published July 1–2, 2026) recovered an internal tracking document describing an organized ~20-person operation with a tiered division of labor, and found — via one of roughly 200 newly discovered operator servers — browser sessions in which a FortiBleed operator was actively logged into the negotiation/victim-chat panels of both the INC Ransom and Lynx ransomware operations. Victim data harvested via FortiBleed infrastructure directly overlapped with a separately discovered INC Ransom open directory, and at least 12 confirmed ransomware deployments (encrypting hundreds of endpoints across affected organizations) have been traced to FortiBleed-derived access. Lynx is independently assessed by MITRE ATT&CK-aligned researchers to be an evolved rebrand/derivative of INC Ransom (MITRE ATT&CK group G1032, aka GOLD IONIC), reusing significant portions of INC's ransomware source code. Confirmed and reported victim organizations span nearly every major sector and geography, including Foxconn, Samsung, Comcast, Siemens, Lenovo, FedEx, Accenture, Oracle, Chevron, AT&T, Mercedes-Benz, and Toyota; roughly 66% of affected organizations have fewer than 200 employees, and IT/managed-service-provider organizations are disproportionately targeted as a pivot point into downstream customer environments.

## MITRE ATT&CK

- T1595 Active Scanning
- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1584 Compromise Infrastructure
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1136 Create Account
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1070 Indicator Removal
- T1040 Network Sniffing
- T1110 Brute Force
- T1555 Credentials from Password Stores
- T1003 OS Credential Dumping
- T1558 Steal or Forge Kerberos Tickets
- T1552 Unsecured Credentials
- T1600 Weaken Encryption
- T1087 Account Discovery
- T1018 Remote System Discovery
- T1082 System Information Discovery
- T1021 Remote Services
- T1550 Use Alternate Authentication Material
- T1039 Data from Network Shared Drive
- T1071 Application Layer Protocol
- T1572 Protocol Tunneling
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1657 Financial Theft
- T1592 Gather Victim Host Information
- T1562 Impair Defenses

## Sources

- [FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations](https://thehackernews.com/2026/07/fortibleed-credential-theft-linked-to.html)
- [FortiBleed credential-theft campaign linked to Lynx ransomware](https://www.bleepingcomputer.com/news/security/fortibleed-credential-theft-campaign-linked-to-lynx-ransomware/)
- [SOCRadar Links FortiBleed Campaign to INC and Lynx Ransomware Operations](https://socradar.io/blog/fortibleed-inc-lynx-ransomware-link/)
- [RH-ISAC: FortiBleed Credential Theft Campaign Attributed to INC and Lynx Ransomware Groups](https://rhisac.org/threat-intelligence/fortibleed-credential-theft-campaign-attributed-to-inc-and-lynx-ransomware-groups/)
- [FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation](https://thehackernews.com/2026/06/fortibleed-targeted-fortigate-firewalls.html)
- [Hackers Using FortigateSniffer Tool That Turns Compromised Firewalls Into Password Collectors](https://cybersecuritynews.com/fortigatesniffer-tool-fortibleed/)
- [Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries](https://arcticwolf.com/resources/blog/active-fortibleed-campaign-impacting-fortinet-devices-across-194-countries/)
- [Inside FortiBleed: Reverse Engineering the CyberStrike Harvester Behind a Global FortiGate Credential Factory](https://arcticwolf.com/resources/blog/inside-fortibleed-reverse-engineering-the-cyberstrike-harvester-behind-a-global-fortigate-credential-factory/)
- [FortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet Patch](https://arcticwolf.com/resources/blog/forticlient-ems-exploited-via-cve-2026-35616-to-deliver-ekz-infostealer-disguised-as-a-fortinet-patch/)
- [CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure](https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-urges-hardening-fortinet-devices-after-reports-credential-exposure)
- [Fortinet Releases Guidance to Address Ongoing Exploitation of Authentication Bypass Vulnerability CVE-2026-24858](https://www.cisa.gov/news-events/alerts/2026/01/28/fortinet-releases-guidance-address-ongoing-exploitation-authentication-bypass-vulnerability-cve-2026)
- [Fortinet Patches CVE-2026-24858 After Active FortiOS SSO Exploitation Detected](https://thehackernews.com/2026/01/fortinet-patches-cve-2026-24858-after.html)
- [FortiBleed: The Most Detailed Breakdown Yet of an Active Russian Credential-Harvesting Operation](https://securityaffairs.com/194004/hacking/fortibleed-the-most-detailed-breakdown-yet-of-an-active-russian-credential-harvesting-operation.html)
- [430,000 FortiGate Devices Exposed in FortiBleed Ransomware Link](https://securityaffairs.com/194645/security/430000-fortigate-devices-exposed-in-fortibleed-ransomware-link.html)
- [Massive Breach Exposes 74,000 Networks, From Oracle and Samsung to a NATO Contractor](https://www.sofx.com/massive-breach-exposes-74000-networks-from-oracle-and-samsung-to-a-nato-contractor/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1118