FortiBleed Fuels INC and Lynx: One Operator Serving Two…

SOCRadar has documented the link between FortiBleed and the INC and Lynx ransomware groups. A single operator accessed the negotiation panels of both groups from infrastructure tied to the same operation.

On July 2, 2026, SOCRadar disclosed a finding that reassembles a piece of the cybercrime marketplace: an operator from the FortiBleed group, an initial access broker specializing in compromising FortiGate firewalls, accessed the negotiation panels of both INC Ransom and Lynx from infrastructure attributable to the same operation. The evidence, surfaced through an operational security error by the attackers, documents how perimeter credentials are monetized by supplying multiple customers.

Key Takeaways

A single FortiBleed operator accessed the negotiation panels of both INC Ransom and Lynx from shared infrastructure, indicating access provisioning to multiple ransomware clients
SOCRadar recovered internal files, logs, and operational documentation due to an attacker security error, gaining visibility into approximately 200 additional operational servers
The campaign targeted roughly 430,000 FortiGate firewalls globally, with 409 targets showing confirmed administrative access and 354 with a full attack chain
At least 12 confirmed ransomware deployments and over 110 million credentials harvested since February 2026
SOCRadar CISO Ensar Seker: the IAB group appears separate from INC/Lynx, which likely pay for access

The Dual Panel: Evidence of Multi-Client Supply

The decisive discovery concerns a single operator active on the negotiation panels of INC Ransom and Lynx. According to SOCRadar's documentation, cited by Dark Reading, the operator used infrastructure traceable to FortiBleed to access victim negotiations for both ransomware groups.

FortiBleed's victim data overlaps with organizations listed on INC Ransom's leak site. SecurityWeek reports that an open directory linked to INC contained datasets with shared victims, and an internal tracking document showed deployment status.

Ensar Seker, CISO of SOCRadar, stated that "the IAB group appears separate from the INC/Lynx gangs, which likely pay for access." This distinction is central: the evidence does not indicate vertical integration, but a supplier serving multiple clients in the access market.

"Finding a single operator working both panels, using infrastructure traceable back to FortiBleed, is the clearest evidence yet that FortiGate credentials harvested through this campaign are being handed off, or used directly, for ransomware deployment" — SOCRadar, via Dark Reading

Seker also described an "access-supply layer" in which compromised Fortinet environments and victim data are collected, validated, and potentially monetized or passed downstream.

FortiBleed's Architecture: Sniffer, Backdoor, and Operational Scale

The technical core of the operation is a custom sniffer written in Go, dubbed "FortiGate Sniffer," deployed on approximately 11,000–19,000 devices according to BleepingComputer. The count dropped after victim notifications. The tool passively intercepts VPN and authentication traffic.

Persistent backdoor accounts with the username "adminin" were found on compromised systems. The operation shows a defined organizational structure: SOCRadar's dossier indicated a core of roughly 20 individuals with structured roles.

Over 200 additional operational servers were discovered beyond the original cluster. Hackread reports 500 servers identified or associated with the operation; other sources use the term "identified" rather than "seized," and any seizure status is not independently confirmed.

Campaign numbers: 409 targets with confirmed admin access, 354 with a full attack chain (VPN → domain controller → domain admin), at least 12 ransomware deployments with hundreds of encrypted endpoints. Harvested credentials exceed 110 million since February 2026.

Expansion Beyond Fortinet: Citrix and the Nextcloud Zero-Day

The FortiBleed operation shows signs of expansion beyond the Fortinet ecosystem. The Hacker News documents the discovery of a dedicated target list for Citrix environments, comprising roughly 29,000 IP addresses and 37 domains. Seker clarified that this material indicates reconnaissance activity, not confirmed exploitation.

SOCRadar also reported that the actors possess at least one undisclosed zero-day vulnerability related to Nextcloud. The vendor stated it had not received any contact from the researcher. The source does not specify affected versions or exploitation method.

What to Do Now

The primary source provides a specific contextual directive. Ensar Seker, CISO of SOCRadar, stated that "access to perimeter security devices can create a clear path for ransomware groups, so organizations should treat exposure as a serious pre-ransomware intrusion risk."

This statement, reported statement, reported by Dark Reading, constitutes the only documented actionable element in the brief. Organizations with exposed FortiGate devices must assess this condition as a pre-ransomware risk, as the dossier specifies no further operational steps.

Source Limitations and Publication Context

All structured information converges on SOCRadar's research. No independent verification of the findings exists at this time. Dark Reading, SecurityWeek, BleepingComputer, and The Hacker News all report SOCRadar's data, with variations in detail level and publication date.

The July 2, 2026 disclosure rests on an attacker operational security error that allowed SOCRadar to access internal files, logs, and operational documentation. This acquisition vector is singular and non-replicable.

The identity of the FortiBleed operators has been withheld for future publications. Financial relationships between the access broker and the ransomware groups are not quantified in the dossier.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references