FortiBleed credential theft campaign tied to INC and Lynx ransomware

Intelligence Summary

A credential-theft campaign dubbed FortiBleed has been linked to INC and the Lynx ransomware ecosystem. The activity targets Fortinet environments, with stolen credentials used to gain or maintain access. Security reporting indicates the credentials may be intended to support additional intrusions beyond the initial compromise. This raises the risk of lateral movement, persistence, and follow-on ransomware deployment. Fortinet users should review exposure, rotate credentials, and monitor for suspicious authentication and access patterns.

Recommended Action

Inventory where FortiGate runs in your environment and treat this as an active remediation item. Until then, watch authentication and outbound traffic logs for the indicators described in the source. This signal rests on a single report, so corroborate it before acting on anything irreversible.

Topics