FortiBleed credential theft campaign tied to INC and Lynx ransomware

Intelligence Summary

A credential-theft campaign dubbed FortiBleed has been linked to INC and the Lynx ransomware ecosystem. The activity targets Fortinet environments, with stolen credentials used to gain or maintain access. Security reporting indicates the credentials may be intended to support additional intrusions beyond the initial compromise. This raises the risk of lateral movement, persistence, and follow-on ransomware deployment. Fortinet users should review exposure, rotate credentials, and monitor for suspicious authentication and access patterns.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics