FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations

The recently discovered financially-motivated FortiBleed campaign has been attributed to INC and Lynx ransomware operations, indicating that the verified, stolen credentials were intended for follow-on intrusions. "An operator tied to FortiBleed's infrastructure was found actively working negotiation panels for both groups, tying mass FortiGate credential theft directly to ransomware deployment

The article reports that the FortiBleed credential-theft campaign against FortiGate firewalls has been directly linked by SOCRadar to the INC and Lynx ransomware-as-a-service operations, with an operator on FortiBleed infrastructure observed actively managing both groups’ negotiation panels.[1][2][3][7][8] This indicates that mass-harvested Fortinet credentials are being operationalized as initial access for confirmed ransomware deployments, rather than remaining a standalone data theft event.[1][2][3][7] From a CyberSE.AI perspective, this exemplifies malicious operational use of compromised infrastructure and credentials that could be chained with automated or AI-assisted tooling for large-scale intrusion, targeting any AI-enabled systems exposed via FortiGate or integrated VPN access. Organizations should apply continuous AI-focused red teaming and credential abuse simulations around remote access, firewall management planes, and any AI agents reachable through these paths to ensure they cannot be trivially compromised or co-opted in similar campaigns.