FortiBleed Campaign Linked to INC and Lynx Ransomware Operations

Researchers uncovered that the FortiBleed campaign used a custom Golang tool to harvest FortiGate credentials from hundreds of thousands of devices, leading to administrative access in hundreds of cases and full compromises in dozens; evidence from exposed operator infrastructure links these stolen credentials directly to ransomware-as-a-service groups INC Ransom and Lynx, confirming that firewall credential theft is being integrated into ransomware deployment workflows.