Ctrl+Alt+Oops: FortiBleed criminal's logins stitch two gangs together

Researchers linked the widespread FortiBleed credential-harvesting campaign to active ransomware operations after discovering an access broker operator logged into both INC and Lynx affiliate panels; attackers intercepted VPN authentication hashes, cracked them with a 45-GPU cluster, gained admin access to hundreds of FortiGate environments, and on hundreds of targets executed full attack chains leading to domain controller and domain admin compromise, with high-profile organizations among the suspected victims.