FortiBleed credential-theft campaign linked to Lynx ransomware
FortiBleed credential theft campaign linked to INC and Lynx ransomware operations targeting 430K firewalls.
Researchers discovered that the FortiBleed credential theft campaign, which compromised over 73,000 Fortinet devices and targeted approximately 430,000 FortiGate firewalls globally, is directly linked to the INC and Lynx ransomware-as-a-service groups. The attackers deployed a custom packet-sniffing tool called 'FortiGate Sniffer' on compromised firewalls to intercept VPN credentials and authentication data, with evidence showing overlapping victims and shared access to ransomware negotiation panels. The operation is estimated to involve roughly 20 members across approximately 500 servers, and researchers suspect exploitation of an undisclosed Nextcloud zero-day vulnerability.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Fortinet?
Get an email when a new story names Fortinet, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe FortiBleed campaign exploited vulnerabilities in over 73,000 Fortinet FortiGate devices, allowing attackers to deploy a custom packet-sniffing tool that silently harvested VPN credentials and authentication data at scale. The direct link to INC and Lynx ransomware groups illustrates how credential theft on perimeter devices is a critical precursor to devastating ransomware attacks. Organizations failed to detect or remediate the compromise in time, partly due to insufficient monitoring of network appliance behavior and delayed patch application. This case underscores that internet-facing security appliances are high-value targets and must be treated with the same — if not greater — urgency as endpoint systems when vulnerabilities are disclosed.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — FortiGate Sniffer
- malware — INC Ransom
- malware — Lynx ransomware
- malware — adminin