Forti Bleed Credential Theft Linked to INC and Lynx Ransomware Operations
Summary: SOCRadar attributed the FortiBleed credential-theft campaign to INC and Lynx ransomware operations after finding an operator logged in to both groups' negotiation panels, tracking scans of roughly 11,250 FortiGate portals in more than 150 countries, confirmed admin access on 409 targets, and full attack-chain completion on 354. The campaign is assessed to have targeted 430,000 FortiGate firewalls and gathered over 110 million credentials, with at least 12 ransomware deployments resulting from the access and a Golang packet sniffer estimated on about 12,000 devices.
What you should know: Over 110 million harvested credentials and 12 ransomware deployments turn a mass credential-theft operation into ransomware access, and SOCRadar found a target list of about 29,000 IP addresses and 37 domains tied to Citrix environments, suggesting the same automated workflow may be pointed at other remote access technologies.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026