FortiBleed Campaign: INC and Lynx Ransomware Groups Weaponize FortiGate Credentials

Executive Summary

Recent intelligence indicates a significant escalation in ransomware operations driven by the 'FortiBleed' campaign. Threat actors are actively exploiting harvested credentials from hundreds of thousands of FortiGate firewall portals to gain initial access. This campaign has been directly linked to the INC and Lynx ransomware groups, who are utilizing this persistent access to conduct large-scale double extortion attacks.

Threat Analysis

The FortiBleed campaign represents a coordinated effort by initial access brokers to compromise perimeter security devices. By obtaining administrative credentials, these actors bypass traditional endpoint defenses, allowing them to move laterally into internal networks. The overlap in victim sets and shared infrastructure between INC and Lynx suggests a collaborative ecosystem where access brokers provide the 'keys to the kingdom' to specialized ransomware operators.

Technical Details

Attackers are performing credential stuffing and exploiting known vulnerabilities to gain administrative control over FortiGate VPN and management interfaces. Once inside, the actors perform domain admin privilege escalation, deploy remote monitoring and management (RMM) tools, and exfiltrate sensitive data before deploying ransomware payloads. The use of legitimate administrative tools allows these groups to maintain a low profile during the reconnaissance phase of the attack.

Attribution Assessment

Security researchers have attributed the initial access phase to a Russian-based broker network. The subsequent deployment of ransomware is attributed to the INC and Lynx operations. These groups have demonstrated high operational maturity, frequently updating their tactics to evade detection and maximize the impact of their double extortion schemes.

Implications

The reliance on perimeter device credentials poses a critical risk to organizations globally. With the average cost of a data breach reaching $5.08 million in 2026, the ability of these groups to automate the exploitation of firewall vulnerabilities significantly lowers the barrier to entry for high-impact ransomware attacks. Organizations must assume that perimeter devices are primary targets for persistent threat actors.

Recommendations

1. Immediate Password Rotation: Force a global password reset for all administrative accounts on FortiGate and other edge devices.
2. Multi-Factor Authentication (MFA): Enforce phishing-resistant MFA for all remote access and management interfaces.
3. Patch Management: Ensure all firmware is updated to the latest versions to mitigate known vulnerabilities exploited in the FortiBleed campaign.
4. Network Segmentation: Isolate management interfaces from the public internet and restrict access to known, trusted IP addresses.
5. Monitoring: Implement enhanced logging for administrative logins and monitor for anomalous lateral movement patterns within the network.