FortiBleed Credential Theft Connected to INC and Lynx Ransomware

SOCRadar's investigation into the FortiBleed incident found a large credential-harvesting campaign targeting FortiGate firewalls that has been linked to ransomware-as-a-service operators INC Ransom and Lynx; researchers uncovered thousands of infected devices, persistent backdoor accounts (username “adminin”), evidence of ransomware deployment against several victims, and indications the attackers are now exploiting a Nextcloud zero-day to extend access, with full technical details and indicators to be published later.