# FortiBleed Credential-Theft Campaign Linked to INC and Lynx Ransomware Operations
A major credential-theft operation targeting Fortinet devices has been directly linked to members of the INC and Lynx ransomware-as-a-service (RaaS) groups, according to new research from SOCRadar. The discovery reveals that stolen credentials from over 73,000 Fortinet devices were likely harvested to fuel future ransomware attacks, suggesting a coordinated threat pipeline from initial access to extortion.
The campaign, dubbed "FortiBleed," represents one of the largest coordinated infrastructure compromise operations targeting firewall devices in recent years, with potential exposure affecting hundreds of thousands of organizations worldwide.
## The Threat: A Credential-Harvesting Pipeline
In early July 2026, security researchers discovered an exposed server containing credentials stolen from tens of thousands of Fortinet FortiGate firewalls. The compromised infrastructure revealed a sophisticated operation designed to extract authentication data at scale and weaponize it for downstream attacks.
The exposed server contained:
What distinguished FortiBleed from typical credential leaks was the systematic nature of the operation. Rather than exploiting a single vulnerability, the attackers deployed a custom packet-sniffing tool directly on compromised firewalls to intercept authentication data in real time.
## Technical Details: The FortiGate Sniffer Toolkit
At the core of the FortiBleed operation is a custom tool called "FortiGate Sniffer," which SOCRadar researchers identified on compromised devices. This tool operates on the firewall itself, positioning attackers to intercept:
By deploying packet sniffers directly on firewalls—devices that sit at the network perimeter—the threat actors gained visibility into credentials that would typically bypass external monitoring. This is a critical technical escalation: rather than attacking external-facing services, attackers compromised the security appliances themselves.
SOCRadar's investigation also uncovered evidence suggesting the operation exploited a previously undisclosed Nextcloud zero-day vulnerability to expand access after initial compromise, though technical details remain under embargo.
Additionally, researchers identified persistent backdoor accounts across compromised systems using the username "adminin"—a subtle misspelling of "admin" that could evade cursory audits.
## The Scale of Compromise: 430,000+ Firewalls Targeted
The full scope of FortiBleed extends far beyond the initially reported 73,000 compromised devices:
| Metric | Count |
|--------|-------|
| FortiGate firewalls targeted globally | 430,000+ |
| Devices with deployed sniffers | ~19,000 |
| Devices with sniffers (post-notification) | ~11,000 |
| Operational infrastructure servers identified | ~500 |
| Additional servers beyond initial discovery | 200+ |
| Estimated threat group size | ~20 members |
The reduction from 19,000 to 11,000 compromised devices after organizations were notified suggests that while Fortinet's incident response was effective, significant compromise persists across the threat landscape.
Researchers also identified 500 servers used by the operation for command-and-control, credential storage, and password-cracking infrastructure—indicating a well-resourced criminal operation with global infrastructure.
## The Ransomware Connection: From Credentials to Extortion
The critical revelation from SOCRadar's investigation is the direct link between the FortiBleed credential-harvesting operation and active ransomware extortion campaigns. Researchers discovered that an individual with administrative access to FortiBleed infrastructure also maintained access to the ransomware negotiation dashboards of both INC and Lynx ransomware groups.
This connection was established through:
Lynx, emerging in mid-2024, is believed by researchers to be a rebrand of the original INC ransomware gang rather than a separate threat actor. INC has operated as a RaaS platform since mid-2023, targeting healthcare, education, government, and other critical sectors across multiple continents.
This organizational link suggests the operation follows a predictable workflow: compromise firewalls → steal credentials → establish persistent access → deploy ransomware → negotiate ransom through leak-site chats.
## Implications for Organizations
The FortiBleed campaign has several alarming implications for enterprise security:
Firewall Security Assumptions Are Broken
Organizations typically assume their perimeter firewalls are trusted security boundaries. FortiBleed demonstrates that even these critical appliances can be compromised, turning them into attack platforms. If a firewall is compromised, it can intercept the very credentials that protect everything behind it.
Initial Access is Commoditized
The direct link between credential theft and ransomware operations shows that threat actors have developed reliable pipelines for obtaining initial access. Stolen credentials bypass authentication controls entirely, allowing attackers to move laterally with legitimate access.
Ransomware RaaS Groups Are Integrated with Credential-Theft Operations
Rather than independent threat actors, the evidence suggests ransomware groups maintain integrated teams focused on credential harvesting, persistence, and extortion. This is a more sophisticated operational model than previously understood.
VPN and Remote Access Are High-Value Targets
The specific focus on intercepting VPN credentials suggests threat actors understand that remote access is a critical asset. Organizations with large remote workforces are particularly vulnerable to credential-based attacks that bypass perimeter defenses.
## Recommendations for Defenders
Organizations should prioritize the following actions:
1. Audit FortiGate device logs for the period of compromise (approximately January–June 2026) to identify indicators of sniffing tool deployment or suspicious administrator account activity.
2. Rotate all credentials that may have been accessed through compromised firewalls, including:
- Administrative accounts
- VPN credentials
- Service accounts with network access
- API keys and tokens
3. Review firewall administrator access logs and identify:
- Unexpected configuration changes
- Unfamiliar administrator accounts (especially "adminin")
- Unusual SSH or management console activity
4. Implement behavioral monitoring on firewall devices to detect packet-sniffing activity or unusual traffic patterns.
5. Conduct incident response at a network level, not just endpoint level. Compromise should be assumed across all systems that authenticate through affected firewalls.
6. Monitor external credential databases and breach tracking sites to determine if your organization's credentials appear in FortiBleed leaks.
7. Implement multi-factor authentication (MFA) on all remote access points to reduce the impact of stolen credentials.
8. Segment networks to limit lateral movement even if credentials are compromised.
---
## HackWire Analysis
Why FortiBleed Represents a Watershed Moment in Ransomware Operations
FortiBleed is not just another credential leak—it's evidence of a structural shift in how ransomware operations achieve initial access. Rather than targeting individual vulnerabilities or user behavior, organized ransomware groups are now operating integrated credential-harvesting campaigns that turn security appliances into attack platforms.
The connection between credential theft and ransomware negotiation dashboards reveals something critically important: threat actors have commoditized initial access. The discovery of roughly 20 team members with "defined roles" suggests ransomware operations now resemble legitimate software companies more than loosely affiliated cybercriminals. There are specialists for firewall compromise, specialists for credential harvesting, and specialists for negotiation and leak-site management.
Compare this to ransomware operations of just three years ago, which typically relied on phishing, unpatched vulnerabilities, or purchased access from third-party brokers. Now, leading ransomware groups are conducting their own infrastructure reconnaissance and credential harvesting at enormous scale—targeting 430,000 firewalls to compromise 19,000.
The healthcare sector should pay particular attention. INC and Lynx have explicitly targeted healthcare organizations, and healthcare credentials stolen from firewalls grant attackers access to patient networks, electronic health records, and billing systems. The credential theft-to-ransomware pipeline poses unique risks to hospitals and medical networks that cannot afford extended outages.
For defenders, this shifts the calculus of security investment. Perimeter defenses alone are insufficient. Organizations must assume that if a firewall can be compromised (and FortiBleed proves it can), then credentials flowing through that firewall are compromised too. This argues for zero-trust architectures, network segmentation, and MFA everywhere—not as aspirational improvements, but as essential baselines.
The ransomware industry's maturation into a structured, credential-focused operation represents a dangerous moment. But it also offers a concrete target for defenders: detect and respond to credential-harvesting infrastructure before ransomware ever hits.
— HackWire Editorial
---
## Related Coverage