THREATNOIR
Subscribe
Back to advisories

FortiBleed Campaign Linked to INC, Lynx Ransomware Attacks

FortiBleed is actively harvesting credentials from 430,000+ FortiGate firewalls and has enabled ransomware deployments by INC Ransom and Lynx operators. Attackers have compromised 110 million credentials and gained admin access to 409 targets, with 12 confirmed ransomware incidents. This is an ongoing operation since February with direct ransomware group coordination.

CRITICALAdvisoryJul 02, 2026
Action required
Immediately audit all FortiGate admin accounts for unauthorized access and lateral movement. Cross-reference your firewall user logs against known INC/Lynx IOCs, check for suspicious VPN logins, and enforce credential rotation for all administrative accounts.
Affected products
FortiGateFortinetSOCRadar
Linked articles
Source links