FortiBleed Campaign: INC and Lynx Ransomware Groups Exploit Stolen FortiGate Credentials

Executive Summary

Recent intelligence indicates a significant escalation in ransomware operations driven by the 'FortiBleed' campaign. Threat actors have successfully harvested administrative credentials from hundreds of thousands of FortiGate firewall portals. This access is being actively leveraged by the INC and Lynx ransomware syndicates to facilitate initial access, VPN compromise, and subsequent domain-wide privilege escalation. The campaign highlights a critical vulnerability in perimeter security management and the efficiency of modern initial access brokers (IABs).

Threat Analysis

The FortiBleed campaign is attributed to a sophisticated Russian-speaking initial access broker (IAB) network. By targeting exposed FortiGate management interfaces, the actors have established a persistent foothold across diverse sectors. The operational model involves a team of approximately 20 individuals who specialize in the full attack chain: from initial credential harvesting to the hand-off of compromised environments to ransomware-as-a-service (RaaS) affiliates. The overlap in victim sets between INC and Lynx suggests a shared infrastructure or a coordinated effort to maximize the monetization of these stolen assets.

Technical Details

Attackers are utilizing automated scanning tools to identify vulnerable FortiGate devices. Once a target is identified, the actors employ credential stuffing and exploitation of known vulnerabilities to gain administrative control. Post-compromise, the actors perform lateral movement by pivoting through the VPN infrastructure. They frequently deploy custom scripts to dump local credentials, which are then used to escalate privileges to Domain Admin. Once domain control is achieved, the actors deploy ransomware payloads, often utilizing double extortion tactics by exfiltrating sensitive data prior to encryption.

Attribution Assessment

Intelligence analysts have linked the campaign to established Russian-speaking cybercriminal elements. The INC and Lynx groups, both known for their aggressive double-extortion tactics, are the primary beneficiaries of this campaign. The infrastructure used for command-and-control (C2) shows significant overlap with previous campaigns attributed to these groups, confirming their direct involvement in the exploitation of the harvested credentials.

Implications

The FortiBleed campaign poses a critical threat to organizations relying on FortiGate firewalls for perimeter security. The ability of these groups to move from initial access to full domain compromise in a short timeframe significantly reduces the window for incident response teams to detect and contain the breach. Organizations should anticipate an increase in targeted attacks as the IABs continue to monetize the massive cache of stolen credentials.

Recommendations

1. Immediate Audit: Organizations must audit all FortiGate management interfaces and ensure they are not exposed to the public internet.
2. Credential Rotation: Force a global password reset for all administrative accounts associated with network perimeter devices.
3. MFA Enforcement: Implement robust Multi-Factor Authentication (MFA) for all VPN and administrative access points, ensuring it is not bypassable via simple credential theft.
4. Monitoring: Enhance logging and monitoring for anomalous administrative logins and unusual outbound traffic from firewall management segments.