FortiBleed Password Stealing Attack Linked to INC and Lynx Ransomware Operations

FortiBleed is a large-scale credential-harvesting campaign that has compromised FortiGate firewalls worldwide using a custom Golang "FortigateSniffer" to intercept authentication traffic; investigators linked the operation to roughly 430,000 targeted devices, confirmed admin-level access on hundreds of systems (409), full attack chains on 354 targets, and at least 12 confirmed ransomware deployments. Analysis of exposed infrastructure and internal documentation ties the harvested credentials to two active RaaS operations (INC Ransom and Lynx), indicating a structured initial-access brokerage operation that directly feeds ransomware economies.