FortiBleed operators tied directly to INC and Lynx ransomware crews

Confirmed reporting, single source. The Hacker News on July 2 reported that the financially-motivated FortiBleed credential-theft campaign has been attributed to the INC and Lynx ransomware operations. Per the writeup, an operator tied to FortiBleed’s infrastructure was observed working the negotiation panels for both groups. That is the finding that matters: the FortiGate credentials aren’t being resold to whoever will buy — the same crew stealing them is spending them.

What was reported

• Campaign: FortiBleed, described as a recently discovered mass credential-theft operation against FortiGate estates. Confidence: high as reported. Fortinet has not, as of this writing, published a fresh advisory on the ransomware attribution.
• Attribution: operator overlap between FortiBleed infrastructure and INC/Lynx ransomware negotiation panels. Confidence: high as reported — telemetry-level, not a claim in a chat channel.
• Intent: the stolen credentials are being spent on follow-on intrusions ending in ransomware deployment. Confidence: high as reported.
• Two groups, one operator: the same person running FortiBleed logistics is running deal-flow for both INC and Lynx. Confidence: high as reported — this is the load-bearing detail.

What is not in the reporting available at time of writing: the exact vulnerability class or CVE ID being used to harvest the FortiGate credentials, victim count, geography, or timeline of the campaign’s start. Treat any secondary summary claiming those specifics as unconfirmed until Fortinet or a named research shop publishes the technical writeup.

Why “one operator, two crews” matters

Ransomware attribution is usually a mess. Affiliates hop between programs, brokers resell to whoever pays, and the same credentials cycle through three or four hands before the encryptor lands. “FortiBleed is INC” or “FortiBleed is Lynx” would be one thing. “FortiBleed is the same operator running deals for both” is a different thing — it collapses two crews’ initial-access story into one pipeline, and it means an environment breached via a FortiGate credential-theft artifact this month is roughly as likely to see an INC note on the domain controllers as a Lynx one.

For defenders, this simplifies triage in one specific way: any FortiGate credential exposure in the current campaign window should be treated as ransomware-precursor traffic, not commodity credential dumping. The dwell before the encryptor is short when the same operator owns both ends.

What to actually do

If you run FortiGate anywhere and haven’t rotated in weeks:

• Rotate FortiGate admin, SSL-VPN user, and any SAML/LDAP creds the appliance holds or brokers. Treat prior exposure as active, not theoretical. The reporting is explicit that the stolen credentials are being weaponized, not warehoused.
• Terminate live SSL-VPN sessions after rotation. Rotation without termination leaves valid tokens replayable in the same way Citrix Bleed 2 sessions did until they were killed.
• Pull recent FortiGate authentication logs and diff against expected admin baselines. Anomalous administrator logins, XML config exports, VPN grants added in the last four weeks — any of those should be treated as compromise indicators until proven otherwise.
• Assume the negotiation clock is short. If a FortiGate-fronted environment sees credential-theft artifacts and hits an INC or Lynx negotiation panel in the same window, the lateral movement between the two events was hands-on, not scripted. Incident response should assume live operators, not a delay.

Management interface reachability from the public internet is the recurring precondition on this class of appliance, same as FortiOS/FortiProxy CVE-2022-40684 and the F5 iControl REST auth bypass before it. FortiBleed does not appear to require it in the reporting available so far — but if you have it, close it.

Watching for

• Fortinet PSIRT statement naming the FortiBleed campaign specifically or updating a related advisory. Unconfirmed at time of publication — treat accordingly.
• CISA KEV addition for whichever underlying flaw or credential-exposure vector the campaign is exploiting. INC and Lynx exploitation would push urgency for federal civilian estates under BOD 22-01.
• Overlap with the Anubis / Citrix Bleed 2 reporting from the same week. Multiple crews leaning on the same operator layer to convert appliance compromise into ransomware is the pattern this newsroom is watching for through the month.
• Sinkhole or takedown activity against FortiBleed infrastructure. The FBI’s NetNut / Popa botnet action this week shows the current appetite for infrastructure disruption. Similar action against a pipeline feeding two active ransomware crews would be highly consequential.

Sourcing

• The Hacker News: FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations, July 2, 2026
• Fortinet PSIRT advisories index: fortiguard.fortinet.com/psirt
• CISA Known Exploited Vulnerabilities catalog: cisa.gov/known-exploited-vulnerabilities-catalog
• Related coverage on 0daynews: Anubis ransomware / Citrix Bleed 2, FortiOS/FortiProxy CVE-2022-40684