MalwarePublished 1 Jul 2026

FortiBleed credential-theft campaign linked to Lynx ransomware

Source Bleeping Computer

Description

The massive FortiBleed credential theft campaign has been linked to the INC and Lynx ransomware operations, suggesting the stolen Fortinet credentials were intended to fuel future network intrusions. [...]

Impact

The campaign resulted in the theft of credentials from tens of thousands of Fortinet FortiGate devices worldwide, enabling attackers to perform network intrusions and facilitate ransomware operations by INC and Lynx groups. The exposure of VPN and authentication credentials compromises the confidentiality and integrity of affected networks. Persistent backdoors and exploitation of additional vulnerabilities increase the risk of prolonged unauthorized access. The linkage to ransomware groups indicates a high risk of ransomware deployment and associated operational disruption and data loss for victim organizations.

Defensive guidance

Organizations should follow Fortinet's official guidance for securing FortiGate devices and monitor for any updates regarding patches or mitigations. Impacted organizations have been notified, and the number of compromised devices has decreased, indicating ongoing remediation efforts. Until official patches or fixes are confirmed, organizations should verify device configurations, remove unauthorized accounts such as 'adminin', and monitor for suspicious activity related to credential theft. Additional mitigation may be required once further technical details and vendor advisories are released.

References

bleepingcomputer.com/news/security/fortibleed-credential-theft-campaign-linked-to-lynx-ransomware/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 1 Jul 2026, 21:51 UTC

References

Community reviews