FortiBleed Campaign Linked to INC and Lynx Ransomware Attacks
Summary
SOCRadar links the FortiBleed credential-harvesting campaign to INC and Lynx ransomware, citing an operator observed in both negotiation panels and overlapping targets. It reports 12 ransomware incidents, with hundreds of endpoints encrypted.
Key points
- SOCRadar links FortiBleed to INC and Lynx ransomware, citing an operator observed logged into both groups’ negotiation panels and overlap between FortiBleed victims and INC targets.
- The campaign has targeted FortiGate firewalls since at least February; attackers used FortigateSniffer to capture network traffic and harvest credentials and password hashes.
- SOCRadar observed scanning against roughly 11,250 FortiGate portals and administrative access on 409 targets.
- SOCRadar says attackers completed the full chain on 354 targets, including VPN compromise, domain-controller access, and domain-admin privileges.
- SOCRadar reports that 12 incidents resulted in ransomware deployment, with hundreds of endpoints encrypted across affected organizations.
- The campaign is estimated to have compromised more than 110 million credentials; analysis of an internal tracking document suggests roughly 20 people were involved.
Article Details
- Event Type
- SOCRadar reported a link between the FortiBleed credential-harvesting campaign and INC Ransom and Lynx ransomware activity, including an operator observed in both ransomware negotiation panels.
- Impact
- SOCRadar reported that attackers gained administrative access to 409 targets and completed the full attack chain on 354. It said 12 incidents led to ransomware deployment, with hundreds of endpoints encrypted. The campaign is estimated to have compromised over 110 million credentials; the article describes the Russian initial access broker attribution as likely.
MITRE ATT&CK
Threat Actors
INC RansomA ransomware-as-a-service operation. SOCRadar reported ransomware deployments and observed an operator logged into its negotiation panel; it also reported overlapping victims with FortiBleed.LynxA ransomware operation whose ransomware was reportedly deployed in incidents linked to FortiBleed. SOCRadar observed an operator logged into its negotiation panel and reported overlapping victims with INC Ransom.
Malware
INC RansomFortiBleed, the large-scale credential-harvesting operation targeting organizations in 150 countries, has led to the deployment of INC Ransom and Lynx ransomware families, SOCRadar reports.LynxFortiBleed, the large-scale credential-harvesting operation targeting organizations in 150 countries, has led to the deployment of INC Ransom and Lynx ransomware families, SOCRadar reports.
Products
Fortinet FortiGateUncovered in mid-June, FortiBleed has been targeting over 430,000 FortiGate firewalls for the deployment of a network sniffer dubbed FortigateSniffer to capture the traffic passing through them and extract cleartextMicrosoft Active DirectoryThe campaign is likely mounted by a Russian initial access broker aiming to gain access to Active Directory domains, steal sensitive information, and establish persistent access.