What We Know
Security reporting says the FortiBleed operation harvested credentials from Fortinet FortiGate devices at scale, with investigators noting organizations in roughly 150 countries were targeted and claims that roughly 430,000 FortiGate devices were exposed. Attackers used that foothold in customer firewalls to steal credentials and gain further access into victim environments.
Multiple analysts and vendors have tied the harvested access to active monetization by ransomware groups: the INC Ransom family and the Lynx ransomware operation have been observed using FortiBleed-derived access to compromise domains and deploy ransomware. Reporting describes the campaign as organized and tiered, with actors beginning to “pile on” additional exploits such as a Nextcloud zero-day to expand intrusion and exploitation opportunities.
Source Comparison
Aligned reportingCorroborates
- BleepingComputer↗Links the large-scale FortiBleed credential-theft campaign to the INC and Lynx ransomware operations, supporting that harvested access was used for ransomware monetization.
- securityweek.com↗Reports FortiBleed targeted organizations in roughly 150 countries and that INC Ransom and Lynx were observed deploying ransomware using access derived from FortiBleed.
- cybersecuritydive.com↗Traces FortiBleed credential theft to the INC and Lynx ransomware operations, supporting the claim that harvested credentials were used to compromise networks and deploy ransomware.
- thehackernews.com↗Summarizes investigations linking FortiBleed-sourced credentials to INC and Lynx ransomware deployments, aligning with the briefing's attribution and monetization claims.
- securityaffairs.com↗Provides the specific figure of about 430,000 exposed FortiGate devices and links that exposure to domain compromise and multiple ransomware incidents, corroborating scale and impact.
- bankinfosecurity.com↗Reports FortiBleed intrusions tied to INC Ransom and the Lynx operation, corroborating that those groups used harvested access to conduct ransomware attacks.
Adds context
- darkreading.com↗Describes FortiBleed actors collaborating with INC and Lynx and notes they "piled on" a Nextcloud zero-day to expand intrusions, adding detail on tactic diversification.
- socradar.io↗Frames FortiBleed as an organized, tiered operation and recaps the link to INC and Lynx, adding perspective on structure, investigation expansion, and why the campaign matters.