FortiBleed credential-theft campaign linked to Lynx ransomware

SOCRadar's research links the large-scale 'FortiBleed' credential-theft campaign — which exfiltrated FortiGate configs and credentials from tens of thousands of devices via a custom packet sniffer and exposed a server containing creds from 73,000+ devices — to the INC and Lynx ransomware operations; the investigation uncovered extensive infrastructure (hundreds of servers), persistent backdoor accounts, evidence of credential-stuffing/cracking activity, overlap with ransomware victim lists, and possible exploitation of a Nextcloud zero-day.