SOCRadar Links FortiBleed Campaign to INC and Lynx Ransomware
Summary
SOCRadar says artifacts link FortiBleed, a Fortinet credential-theft operation, to INC and Lynx ransomware negotiation panels. Researchers report targeting over 430,000 firewalls and suspect an undisclosed Nextcloud zero-day was used.
Key points
- An exposed server reportedly contained credentials stolen from more than 73,000 Fortinet devices, along with FortiGate configuration files.
- SOCRadar says a custom FortiGate Sniffer captured VPN credentials and other authentication data from network traffic.
- SOCRadar cites server artifacts and browser sessions showing access to INC and Lynx ransomware negotiation panels; this supports a link to the platforms but does not independently confirm every aspect of the campaign.
- Researchers say the operation targeted over 430,000 FortiGate firewalls and deployed traffic sniffers on about 19,000 devices; after organizations were notified, about 11,000 devices remained compromised.
- SOCRadar reports identifying roughly 500 operational servers and victim information that overlaps with organizations later listed on the INC leak site.
- Researchers suspect attackers exploited a previously undisclosed Nextcloud zero-day to expand access, but technical details have not been released.
- SOCRadar says it found persistent backdoor accounts using the username “adminin” and is continuing efforts to recover ransomware decryption keys.
Article Details
- Event Type
- Credential-theft campaign linked by SOCRadar to INC and Lynx ransomware operations
- Impact
- The campaign exposed credentials from more than 73,000 Fortinet devices, reportedly targeted over 430,000 FortiGate firewalls, and deployed traffic sniffers on approximately 19,000 devices. After impacted organizations were notified, researchers said the number of compromised devices had fallen to around 11,000. SOCRadar also reported finding roughly 500 operational servers, evidence of access to both groups’ ransomware negotiation panels, and victim information overlapping with organizations later listed on the INC leak site. Researchers believe the operation may have exploited an undisclosed Nextcloud zero-day to expand access, but technical details have not been released.
MITRE ATT&CK
T1040 · Network SniffingAttackers used a custom packet-sniffing tool on compromised FortiGate firewalls to intercept VPN credentials and other authentication data from network traffic.T1110.002 · Password CrackingThe exposed campaign infrastructure was used to crack password hashes, according to the article.T1110.004 · Credential StuffingThe exposed campaign infrastructure was used to perform credential-stuffing attacks, according to the article.
Threat Actors
INCSOCRadar linked FortiBleed infrastructure to members of the INC ransomware group, citing evidence that an individual with access to the infrastructure also accessed the group’s negotiation panel. The reported evidence supports a link but does not establish that the group as a whole operated the credential-theft campaign.LynxSOCRadar linked FortiBleed infrastructure to members of the Lynx ransomware group, citing evidence that an individual with access to the infrastructure also accessed the group’s negotiation panel. The reported evidence supports a link but does not establish that the group as a whole operated the credential-theft campaign.
Malware
INC ransomwareThe FortiBleed campaign, which stole credentials from more than 73,000 Fortinet devices, has now been linked to the INC and Lynx ransomware operations.LynxThe FortiBleed campaign, which stole credentials from more than 73,000 Fortinet devices, has now been linked to the INC and Lynx ransomware operations.
Vendors
Products
Tools
Industries
EducationINC Ransom has operated as a ransomware-as-a-service platform since mid-2023, targeting organizations across healthcare, education, government, and other sectors worldwide.GovernmentINC Ransom has operated as a ransomware-as-a-service platform since mid-2023, targeting organizations across healthcare, education, government, and other sectors worldwide.HealthcareINC Ransom has operated as a ransomware-as-a-service platform since mid-2023, targeting organizations across healthcare, education, government, and other sectors worldwide.