FortiBleed IAB Operation Confirmed Feeding INC Ransom and Lynx RaaS Groups; 430K FortiGate Devices Targeted, 110M+ Credentials Harvested

SOCRadar's Threat Research Unit has formally linked the 'FortiBleed' credential-harvesting campaign — which deployed a custom Golang-based packet sniffer (FortigateSniffer) across more than 430,000 FortiGate firewalls in 150+ countries — to active ransomware deployments by INC Ransom and Lynx. Investigators found a single operator simultaneously logged into negotiation panels for both RaaS groups, with victim data from FortiBleed overlapping directly with INC Ransom's leak site. The campaign is assessed as a structured ~20-person IAB operation; at least 12 ransomware deployments have been confirmed with hundreds of endpoints encrypted. Any organization running FortiGate VPNs should treat all credentials active during the exposure window as compromised and rotate immediately.

The campaign is assessed as a structured ~20-person IAB operation; at least 12 ransomware deployments have been confirmed with hundreds of endpoints encrypted.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.