# FortiBleed Credential Theft Campaign: FortigateSniffer Tool Deployed Against 430,000+ FortiGate Firewalls, Linked to INC Ransom and Lynx Ransomware

> A Russian-speaking initial access broker ran a large-scale credential-harvesting operation dubbed 'FortiBleed' that combined reused credentials, mass brute-force, and a custom Golang packet-sniffing tool (FortigateSniffer) abusing FortiOS's native 'diagnose sniffer packet' command to intercept VPN and directory-service credentials from over 430,000 internet-facing FortiGate firewalls. SOCRadar's Threat Research Unit confirmed an operator with access to the FortiBleed infrastructure was simultaneously logged into the negotiation panels of INC Ransom and Lynx ransomware, the first confirmed pipeline from mass firewall credential theft to ransomware deployment.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1124
- **ID:** TL-2026-1124
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** INC Ransom (Russia)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2022-40684, CVE-2023-27997, CVE-2024-21762

## Description

FortiBleed is an operational credential-theft campaign, not a single CVE. Security researcher Volodymyr "Bob" Diachenko first identified the operation on 2026-06-13 after discovering a publicly exposed threat-actor server hosting a structured database of validated FortiGate administrator and VPN credentials alongside the group's attack tooling. Within 48 hours, Recorded Future, Field Effect, SOCRadar, Hudson Rock, Bitsight, and Arctic Wolf independently validated portions of the dataset, and by 2026-06-19 the confirmed tally of devices with verified working credentials had grown to 86,644 across 194 countries. Fortinet's PSIRT publicly stated the activity is 'not a new Fortinet vulnerability,' attributing it instead to credential reuse tied to prior advisories FG-IR-26-060 and FG-IR-25-647, combined with brute-force attacks against devices lacking strong passwords and MFA. Independent researchers additionally note that a meaningful share of the original leaked configuration files plausibly trace back to historically exploited FortiOS SSL-VPN/administrative-interface flaws -- CVE-2022-40684 (authentication bypass), CVE-2023-27997 'XORtigate' (heap buffer overflow), and CVE-2024-21762 (SSL VPN out-of-bounds write) -- all of which allowed unauthenticated attackers to pull FortiGate configuration files (and thus stored credential hashes) from unpatched, internet-facing devices in prior exploitation waves dating back to 2022.

Once credentials were reused or brute-forced onto a device (SSH brute-force with 16 wordlists and SSL-VPN credential stuffing at up to 25,000 threads yielded 237,330 valid credentials in one tracked pipeline), operators deployed FortigateSniffer, a Golang binary compiled for both Linux and Windows with an entirely Russian-language interface. The tool abuses the legitimate FortiOS diagnostic command 'diagnose sniffer packet' to passively capture authentication traffic across roughly two dozen protocols -- Kerberos, RADIUS, NTLM, RDP, LDAP, MSSQL, SMB, FTP, Telnet, and WinRM among them -- without dropping any traditional malware on the appliance. Captured SSH terminal output is converted to .pcapng via an internal 'SNIFTRAN' conversion engine and processed through a 'PCAP Deep Analysis Toolkit (v5.0)' that extracts cleartext credentials, NTLM hashes, Kerberos tickets, and session cookies. To minimize detection, the sniffer only runs 07:00-18:00 Moscow Time and applies GeoIP-based filtering via a binary-search-optimized ipgeo.csv allow/deny list, blending malicious capture windows into normal business-hours traffic patterns.

A compounding weakness is FortiGate's legacy SHA-256-with-salt admin credential hashing, which is comparatively crack-friendly versus the PBKDF2 hashing introduced in FortiOS 7.2.11, 7.4.8, and 7.6.1; critically, upgrading FortiOS alone does not rehash an existing admin's password to PBKDF2 until that admin logs in again post-upgrade, leaving legacy hashes crackable indefinitely on unrefreshed accounts. Operators ran offline cracking on a 45-node Hashtopolis/Hashcat GPU cluster, dynamically renting additional compute from vast.ai and orchestrating cracking jobs through a Telegram bot. An internal tracking document recovered from one of roughly 200-500 operational servers revealed an organized structure of about 20 people with defined roles: a small core of primary operators driving high-impact intrusions, dedicated technical specialists, and a back-office layer of junior operators. Post-compromise activity included creation of persistent backdoor admin accounts (observed names: adminin, support, ssl-admin, svc_monitor, forticloud, fortiuser, fortinet-support, fortinet-tech-support), Kerberoasting and RC4 ticket cracking for lateral movement, and staged exfiltration of DFS backup shares -- including a confirmed 2026-06-15 exfiltration event against a NATO-affiliated defense contractor.

SOCRadar's whitepaper 'Dismantling FortiBleed' establishes that campaign infrastructure produced 409 targets with confirmed administrative access, 354 full domain compromises, and at least 12 confirmed ransomware deployments. Crucially, one operator with access to FortiBleed's back-end infrastructure was found actively logged into the negotiation panels of both INC Ransom (active since mid-2023) and Lynx (emerged mid-2024 and widely assessed to be an INC rebrand sharing substantial source code), with victims listed on INC Ransom's leak site overlapping directly with FortiBleed's victim dataset. This is the first confirmed operational link tying mass FortiGate credential theft directly to ransomware-as-a-service deployment, rather than opportunistic reuse by an unrelated actor. Both ransomware families follow a double-extortion model: INC Ransom uses Rust-rewritten Windows/Linux/ESXi encryptors (.inc extension, INC-README.txt/.html notes) with Cobalt Strike, PsExec, WinPEAS, and Mimikatz for lateral movement and privilege escalation; Lynx encrypts with AES-128-CTR plus Curve25519 Donna (.lynx extension), terminates backup/database/mail-server processes (MSSQL, Veeam, Exchange), deletes Volume Shadow Copies, and delivers ransom notes via desktop wallpaper changes and networked-printer output, directing victims to a Tor negotiation portal and the clearnet leak site lynxblog[.]net.

## MITRE ATT&CK

- T1595 Active Scanning
- T1596 Search Open Technical Databases
- T1591 Gather Victim Org Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1136 Create Account
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1040 Network Sniffing
- T1110 Brute Force
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1558 Steal or Forge Kerberos Tickets
- T1187 Forced Authentication
- T1212 Exploitation for Credential Access
- T1087 Account Discovery
- T1018 Remote System Discovery
- T1069 Permission Groups Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1074 Data Staged
- T1102 Web Service
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [FortiBleed credential-theft campaign linked to Lynx ransomware](https://www.bleepingcomputer.com/news/security/fortibleed-credential-theft-campaign-linked-to-lynx-ransomware/)
- [FortiBleed campaign used custom FortiGate sniffer to steal credentials](https://www.bleepingcomputer.com/news/security/fortibleed-campaign-used-custom-fortigate-sniffer-to-steal-credentials/)
- [CISA warns Fortinet users to secure devices after FortiBleed leak](https://www.bleepingcomputer.com/news/security/cisa-warns-fortinet-users-to-secure-devices-after-fortibleed-leak/)
- [SOCRadar Links FortiBleed Campaign to INC and Lynx Ransomware Operations](https://socradar.io/blog/fortibleed-inc-lynx-ransomware-link/)
- [Dismantling FortiBleed: Inside a Russian Fortinet Compromise Operation](https://socradar.io/resources/whitepapers/dismantling-fortibleed-inside-a-russian-fortinet-compromise-operation/)
- [FortiBleed: 86,644 Fortinet Firewalls Compromised — SOCRadar Research](https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/)
- [FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations](https://thehackernews.com/2026/07/fortibleed-credential-theft-linked-to.html)
- [FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation](https://thehackernews.com/2026/06/fortibleed-targeted-fortigate-firewalls.html)
- [Hackers Using FortigateSniffer Tool That Turns Compromised Firewalls Into Password Collectors](https://cybersecuritynews.com/fortigatesniffer-tool-fortibleed/)
- [FortiBleed: Inside the Campaign That Cracked 75,000 Fortinet Firewalls](https://www.picussecurity.com/resource/blog/fortibleed-inside-the-campaign-that-cracked-75000-fortinet-firewalls)
- [CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure](https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-urges-hardening-fortinet-devices-after-reports-credential-exposure)
- [Analysis of Reported Credential Compromise of FortiGate Devices](https://www.fortinet.com/blog/psirt-blogs/analysis-of-reported-credential-compromise-of-fortigate-devices)
- [FortiBleed: 86,000 Fortinet Device Credentials Compromised](https://www.securityweek.com/fortibleed-86000-fortinet-device-credentials-compromised/)
- [430,000 FortiGate Devices Exposed in FortiBleed Ransomware Link](https://securityaffairs.com/194645/security/430000-fortigate-devices-exposed-in-fortibleed-ransomware-link.html)
- [Lynx Ransomware: A Rebranding of INC Ransomware](https://unit42.paloaltonetworks.com/inc-ransomware-rebrand-to-lynx/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1124