3AUG

Lynx crew cashes in FortiBleed haul

3 min read

16:08UTC

SOCRadar tied the 86,644-credential FortiGate harvest to the Lynx ransomware crew, which cracked legacy passwords offline on a 45-GPU rig rather than exploiting any flaw.

← Back to KEV deadlines fell from 14 days to three Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Rotation, not patching, resets a FortiGate estate once Lynx has cracked its stored credentials.

SOCRadar, a threat-intelligence firm, has attributed the theft of 86,644 Fortinet FortiGate firewall credentials to the Lynx/INC Ransom ransomware operation, the company said this week. The set was flagged by Britain's National Cyber Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA) on 18 June as privately held ; SOCRadar assesses the crew has run it since at least February 2026. Lynx needs no software exploit to use it. It logs in. Named in the exposed set are Samsung, Siemens, Oracle, DHL, Accenture, Infosys and Foxconn. ¹

Lynx cracked the passwords offline on a 45-GPU Hashtopolis cluster, a rig of 45 graphics processors coordinated to test guesses at speed, working against legacy FortiOS credentials still stored as SHA-256 hashes. Fortinet's 2025 upgrade re-hashed stored credentials to PBKDF2, but estates that skipped the upgrade never made the switch. SHA-256 computes fast, so a graphics-card rig can test billions of guesses a second against a stolen hash; PBKDF2 deliberately runs each guess through thousands of iterations, which is what makes an offline crack uneconomic.

Because the cracking ran on Lynx's own hardware, no failed-login telemetry appeared on any victim device. The first thing a defender sees is a successful login with a valid credential, not a brute-force spike. For the seven named blue-chips, that inverts the usual detection assumption and leaves credential rotation, not a patch, as the only clean reset.

Deep Analysis

In plain English

A FortiGate is a firewall and remote-access box made by Fortinet that many companies use to let staff log in from home. Researchers found that 86,644 passwords for these devices had been stolen. British and American cyber-security agencies knew about the theft in June but treated it as a private matter rather than a public warning. A criminal group called Lynx, which also goes by INC Ransom, is now accused of cracking those passwords using 45 powerful graphics cards of the kind used for gaming, chained together to guess them fast. The problem is that Fortinet stored the passwords in an old, weak format that makes guessing far easier than it should be. Anyone still using one of the leaked logins could have their network broken into.

Deep Analysis

Root Causes

Fortinet has never forced a password reset across its FortiGate install base when hashing weaknesses surface, because a mass reset would sever SSL-VPN sessions for every customer at once; the vendor treats reset campaigns as a continuity risk rather than a security obligation, leaving legacy SHA-256 hashes live on firmware branches still under support.

Many FortiGate SSL-VPN portals authenticate straight against on-premises Active Directory without enforcing multi-factor login on the VPN hop itself, a configuration Fortinet's own hardening guides discourage but do not block by default. A cracked portal password on this class of device can open a route straight to the domain controller, well beyond the firewall it was meant to guard.

Escalation

Lynx/INC Ransom's usual pattern, per Recorded Future's ransomware tracking, runs two to six weeks from initial access to deploying an encryptor. Any organisation with an unreset leaked password may already be inside that window without knowing it.

What could happen next?

Risk
Any organisation that reused a FortiGate SSL-VPN password included in the 86,644-credential set remains exposed until it forces a reset, regardless of whether Lynx/INC Ransom or another buyer holds the cracked list.
Precedent
The six-week gap between the June private flag and July's public cracking claim will likely sharpen debate over when agencies should convert a privately held credential warning into a public one.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: Fortinet's own 2021 SSL-VPN leak (CVE-2018-13379) put more than 500,000 device credentials on a hacking forum for free; Conti and other ransomware affiliates spent the following year working through the list, breaching organisations that had never rotated the exposed logins.

Counter-parallel: LastPass's 2022 vault theft exposed customer data through a similar cloud-storage compromise, but the vaults themselves resisted mass offline cracking because LastPass had already moved to 100,100 rounds of PBKDF2. The gap between a leak that becomes a breach epidemic and one that does not is often the hashing algorithm alone.

Forcing a FortiGate password reset across an enterprise's SSL-VPN estate means a coordinated helpdesk operation and a temporary remote-access outage, which is why many IT Teams delay resets rather than absorb the disruption immediately.

Coalition's 2026 cyber-claims data puts the average incident-response cost for a confirmed VPN-credential compromise at $370,000 before any ransom payment, a figure that makes the reset-versus-outage calculus look worse the longer it is deferred.

Consensus view: Recorded Future's Insikt Group assesses that FortiOS's unsalted, unstretched SHA-256 hashing meant a 45-GPU Hashtopolis cluster could exhaust most of the 86,644-password set within days, not the weeks the joint NCSC/CISA private-set advisory implied back in June.

Counter-view: Fortinet's own PSIRT has pushed back on the Lynx/INC Ransom attribution, arguing SOCRadar's finding rests on cracking-forum chatter rather than a confirmed sale, and that harvested credential sets typically pass through two or three resellers before the group that ultimately exploits them becomes clear.

Key tension: Whether the six-week gap between June's private flag and July's public cracking claim reflects slow criminal tradecraft, or a quiet exploitation window that neither NCSC nor CISA could see while treating the set as privately held.

Sources:BleepingComputer

Mentions:SOCRadar →Fortinet →NCSC →CISA →Samsung Electronics →Siemens →Oracle →Accenture →Infosys →Foxconn →FortiBleed →INC Ransom →

First Reported In

Update #9 · FortiBleed harvest linked to Lynx crew

BleepingComputer· 4 Jul 2026

Read original →

Causes and effects

Caused by

86,644 Fortinet logins become a hit list

The FortiBleed credential harvest privately flagged in June is now confirmed exploited by the Lynx/INC Ransom crew.

Occurred 18 Jun 2026

Read story →

This Event

Lynx crew cashes in FortiBleed haul

A credential set flagged as privately held in June now sits with a ransomware crew that authenticates rather than exploits, so rotation, not patching, is the only reset.

Led to

One operator ran both ransomware brands

The provisional Lynx attribution from 1 July now rests on a shared negotiation-panel operator rather than tooling overlap alone.

Occurred 8 Jul 2026

Read story →

CISA's KEV list runs a month late

SOCRadar's attribution of the FortiGate credential harvest to Lynx and INC Ransom is part of the same Fortinet exposure thread FortiSandbox now extends.

Occurred 16 Jul 2026

Read story →

Different Perspectives

Group-IB

Group-IB, headquartered in Singapore, documented on 19 March that The Gentlemen began inside Qilin's own affiliate programme and split from it over a payment dispute. Its analysis makes this window's leak-site tally readable as a fracture inside one ransomware operation rather than the arrival of an unknown crew.

ENISA

ENISA placed EU drinking water and wastewater in its cyber risk zone for the first time on 28 May, finding one in three water entities had never run a risk assessment. CISA's 30 July advisory to American operators reads as the operational sequel to a gap European regulators had already documented two months earlier.

House of Lords and NCSC

The Cyber Security and Resilience Bill sits at House of Lords committee stage, its amendment paper running to 23 July. Separately, the NCSC guidance CISA cited when directing water operators to disconnect controllers is version 1.0 from March 2024, a two-year-old British document doing operational work in an American alert published last week.

heise online

heise online reported on 27 July that Russian state attackers, named as APT28, ran the hotel WiFi credential-harvesting campaign. Its attribution is firmer than ReliaQuest's own hedged low-to-medium confidence assessment of the same intrusion, a difference in national reporting posture rather than a settled dispute over who is responsible.

CISA and ReliaQuest

CISA compressed remediation deadlines under BOD 26-04 while, in the same window, telling water and wastewater operators to disconnect internet-exposed controllers rather than patch them. ReliaQuest, investigating the hotel WiFi campaign, held its assessment of the intrusion route at low-to-medium confidence and declined to name a state sponsor.

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.