FortiBleed Campaign Linked to INC, Lynx Ransomware Attacks

Researchers say credentials harvested from hundreds of thousands of FortiGate firewalls are being used to facilitate ransomware attacks by the INC and Lynx operations. The post FortiBleed Campaign Linked to INC, Lynx Ransomware Attacks appeared first on SecurityWeek .

SecurityWeek reports that the FortiBleed campaign involves large-scale harvesting of administrative and VPN credentials from FortiGate firewalls, and researchers now link these stolen credentials to ransomware attacks by the INC and Lynx operations.[8] Other sources estimate tens of thousands of Fortinet devices across 194 countries have had valid credentials exposed, impacting government, critical infrastructure, and major enterprises.[3][4] From a CyberSE.AI perspective, any AI agents or models that rely on Fortinet-managed networks, VPNs, or identity infrastructure are indirectly exposed to elevated compromise risk, since attackers with firewall/VPN access can pivot into environments hosting AI services, tamper with data flows, or deploy ransomware that disrupts AI operations. Organizations should treat this as an AI supply-chain and infrastructure dependency risk, mapping where AI systems rely on Fortinet devices, and then apply rigorous credential rotation, MFA enforcement, network segmentation, and continuous monitoring to prevent compromise of AI agents and their underlying data and compute environments.