After gaining a foothold in thousands of Fortinet firewalls, the attackers are starting to monetize that access, and are also piling on a Nextcloud zero-day bug.
Researchers say credentials harvested from hundreds of thousands of FortiGate firewalls are being used to facilitate ransomware attacks by the INC and Lynx operations. The post FortiBleed Campaign Linked to INC, Lynx Ransomware Attacks appeared first on SecurityWeek.
June 2026: FortiBleed Cracks Fortinet Firewalls, Supply Chain Worms Hit npm and PyPI June 2026 was headlined by FortiBleed, a Russian-attributed credential harvesting campaign that exposed over 86,000 Fortinet firewalls
The massive FortiBleed credential theft campaign has been linked to the INC and Lynx ransomware operations, suggesting the stolen Fortinet credentials were intended to fuel future network intrusions. […]
SOCRadar Links FortiBleed Campaign to INC and Lynx Ransomware Operations SOCRadar’s Threat Research Unit (STRU) has linked the FortiBleed credential-harvesting campaign to two active ransomware-as-a-service operations,
The threat actors engineered a Golang-based sniffer to target 430,000 FortiGate firewalls and identify 110 million credentials in the ongoing global campaign.
Security firm SOCRadar says the large-scale FortiBleed campaign targeting Fortinet FortiGate devices used custom sniffers to harvest authentication secrets from compromised firewalls and steal credentials. […]
A database of over 86,000 confirmed working credentials was created during the credential-harvesting campaign. The post Fortinet Responds to FortiBleed Campaign appeared first on SecurityWeek.
Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims SOCRadar Dark Web Team identified new underground activity involving alleged FortiBleed-related access, an alleged 529,892-record customer database linked to French retailer Sens Unique Paris, and a claimed libsodium and NaCl zero-day package. Additional listings advertised alleged KodexGlobal portal access, a 2 million-card […]
Die Kampagne FortiBleed verschafft Kriminellen Zugriff auf rund 75.000 Fortinet-Systeme in fast 200 Ländern, ohne eine neue Schwachstelle auszunutzen. Grundlage sind gestohlene und wiederverwendete Admin-Passwörter, die über 21.000 Unternehmen weltweit bedrohen. CERT.at rechnet mit zeitnaher Verwertung der erbeuteten Zugänge.