FortiBleed Credential-Theft Campaign Linked to Lynx Ransomware

2026-07-02

SOCRadar has connected the FortiBleed campaign to the Lynx ransomware. This campaign compromised over 430,000 FortiGate firewalls, with approximately 11,000 still vulnerable, by harvesting credentials using a custom "FortiGate Sniffer" tool and a suspected unpatched Nextcloud zero-day exploit.