FortiBleed Credential Theft Campaign Attributed to INC and Lynx Ransomware Groups

Executive Summary

On 02 July 2026, SOCRadar researchers linked the financially-motivated campaign dubbed “FortiBleed” to the Ransom and Lynx ransomware operations, marking the first confirmed instance connecting mass FortiGate credential theft to actual ransomware deployment. SOCRadar reported that an operator tied to FortiBleed infrastructure was found actively working negotiation panels for both groups, tying mass FortiGate credential theft directly to ransomware deployment for the first time.

Key Takeaways

• Confirmed intrusion chain: SOCRadar claims to have tracked scanning activity against approximately 11,250 FortiGate portals in more than 150 countries, followed by confirmed admin-level access on 409 targets and successful completion of the full attack chain on 354 of them 
• Ransomware impact: At least 12 ransomware deployments have reportedly resulted from this access, causing hundreds of endpoints to be encrypted across affected organizations 
• Operational security failure: The activity was exposed after an operational security error on the part of the attackers left a server containing credentials stolen from thousands of Fortinet appliances exposed on the internet 
• Attribution: Tooling, logs, and working hours indicate that the activity is the work of a Russian-speaking threat actor who likely operates as an initial access broker 
• Organizational structure: SOCRadar discovered an internal document that indicates an organized operation comprising about 20 people with a clear division of labor, with a small core of lead operators driving most high-impact intrusions, backed by specialists and support staff 
• Targeting profile: Much of the targeting singled out manufacturing, technology, and logistics sectors in Latin America and the Asia Pacific regions 
• Zero-day possession: The threat actors are believed to be in possession of at least one zero-day vulnerability in Nextcloud, with the threat intelligence firm actively coordinating with the affected vendor 

Technical Details

The link between FortiBleed and ransomware groups is based on one of the 200 newly discovered servers associated with the FortiBleed infrastructure that granted visibility into internal files, logs, and operational documentation. Analysis showed an operator with access to FortiBleed infrastructure was found logged in to both INC Ransom and Lynx negotiation panels, with victims listed by INC Ransom overlapping with data from the campaign.

Related Vulnerability Exploitation

Separately, eSentire reported observing threat actors exploiting a flaw in Fortinet FortiClient EMS (CVE-2026-35616, CVSS score: 9.1) to deploy an information stealer called EKZ Stealer against a customer in the energy, utilities, and waste sector with the end goal of harvesting credentials from Chromium-based browsers and Firefox and exfiltrating them via PowerShell. This exploitation aligns with the broader credential-theft ecosystem surrounding Fortinet infrastructure disclosed in this reporting period.

Recommended Actions

• Patch and audit all internet-facing FortiGate/FortiClient EMS deployments, prioritizing CVE-2026-35616.
• Rotate credentials on any FortiGate device that may have been exposed to scanning activity, given the scale (430,000 devices targeted).
• Monitor for anomalous PowerShell activity tied to credential exfiltration.
• Watch for Nextcloud zero-day advisories as vendor coordination progresses.

TTPs (MITRE ATT&CK Mapping)