FortiBleed Campaign Linked to INC and Lynx Ransomware Operations

Gbhackers •Divya • July 2, 2026

A direct operational link between the large-scale FortiBleed credential-harvesting campaign and two active ransomware-as-a-service (RaaS) groups: INC Ransom and Lynx. This finding provides the first confirmed evidence that mass theft of FortiGate credentials is being integrated into ransomware deployment processes, significantly increasing the threat posed by exposed firewall infrastructure. FortiBleed Campaign Linked to INC and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FortiBleed Campaign Links Credential Theft to Ransomware Operations The FortiBleed campaign has been linked to two ransomware groups, INC Ransom and Lynx, through an operational security lapse that revealed one actor's simultaneous access to both groups' negotiation panels. This campaign targeted over 430,000 Fortinet firewalls, successfully harvesting credentials from at least 30,000 devices. Researchers confirmed admin-level access on 409 targets, with ransomware deployment occurring on 12 of those. The attack exploited SSL VPN authentication hashes, utilizing a 45-GPU cluster for cracking. The findings indicate that FortiBleed is not merely a credential theft operation but a precursor to ransomware attacks, significantly raising the stakes for organizations using FortiGate infrastructure. 3 sources 70

Extracted Entities

FortiBleed Campaign Linked to INC and Lynx Ransomware Operations

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Ransomware Groups (2)