Campaign DetailSource-backed corpus

FortiBleed Credential Exposure Campaign

FortiBleed is retained as a Fortinet/FortiGate credential-exposure campaign in which public reporting tied exposed or stolen Fortinet edge credentials to downstream ransomware activity involving INC Ransom and Lynx. IntelliOS treats FortiBleed as a campaign/operation context rather than proof that every exposed Fortinet environment was compromised or deployed with ransomware.

Last updated Jul 08, 2026, 8:00 PM EDT

Actor Mapping

Mapped Threat Actors

INC Ransom Lynx

Targeting

Target Sectors / Countries

TechnologyInformation ServicesManufacturingProfessional Services

Tradecraft

ATT&CK / Techniques

T1190T1133T1078T1552T1486

Tools / Observables

Malware, Tools, CVEs

INC Ransom downstream ransomware contextLynx downstream ransomware context

Source Reconciliation

How IntelliOS Is Treating This Campaign

Campaign rows are retained as source-backed context. Actor mappings do not automatically merge actor records; SOCRadar, MITRE, Mandiant, CrowdStrike, Microsoft, and other future sources can disagree on boundaries, aliases, or campaign ownership.

FortiBleed is retained as campaign context and exposure/ransomware linkage reporting. IntelliOS does not republish raw exposed-instance lists, credentials, victim lists, leak-site data, or unsupported claims.

IntelliOS

Related Intel Products

Flash Threat Intel BriefFortiBleed Fortinet Credential ExposureStatic IntelliOS brief for FortiBleed credential exposure, Fortinet/FortiGate response priorities, and source-backed caveats.One-Page Cheat SheetSophos Firewall VPN Bruteforcing and FortiBleed AdvisoryAdjacent firewall/VPN credential-risk advisory that keeps Sophos brute-forcing distinct from FortiBleed exposure.

Citations

Source Trust / Citations

[1] FortiBleed campaign linked to INC and Lynx ransomware operationsSOCRadar
[2] Critical FortiBleed campaignRecorded Future
[3] FortiBleed campaign traced to INC and Lynx ransomware operationsCybersecurity Dive
[4] FortiBleed credential theft linked to INC and Lynx ransomwareThe Hacker News