Skip to content
You can now search across every topic, entity and event.What's new
Cybersecurity: Threats and Defences
5SEP

Lynx crew cashes in FortiBleed haul

3 min read
12:09UTC

SOCRadar tied the 86,644-credential FortiGate harvest to the Lynx ransomware crew, which cracked legacy passwords offline on a 45-GPU rig rather than exploiting any flaw.

← Back to Four privileged platforms under live attackJump to analysis ↓
TechnologyDeveloping
Key takeaway

Rotation, not patching, resets a FortiGate estate once Lynx has cracked its stored credentials.

SOCRadar, a threat-intelligence firm, has attributed the theft of 86,644 Fortinet FortiGate firewall credentials to the Lynx/INC Ransom ransomware operation, the company said this week. The set was flagged by Britain's National Cyber Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA) on 18 June as privately held ; SOCRadar assesses the crew has run it since at least February 2026. Lynx needs no software exploit to use it. It logs in. Named in the exposed set are Samsung, Siemens, Oracle, DHL, Accenture, Infosys and Foxconn. 1

Lynx cracked the passwords offline on a 45-GPU Hashtopolis cluster, a rig of 45 graphics processors coordinated to test guesses at speed, working against legacy FortiOS credentials still stored as SHA-256 hashes. Fortinet's 2025 upgrade re-hashed stored credentials to PBKDF2, but estates that skipped the upgrade never made the switch. SHA-256 computes fast, so a graphics-card rig can test billions of guesses a second against a stolen hash; PBKDF2 deliberately runs each guess through thousands of iterations, which is what makes an offline crack uneconomic.

Because the cracking ran on Lynx's own hardware, no failed-login telemetry appeared on any victim device. The first thing a defender sees is a successful login with a valid credential, not a brute-force spike. For the seven named blue-chips, that inverts the usual detection assumption and leaves credential rotation, not a patch, as the only clean reset.

Deep Analysis

In plain English

A FortiGate is a firewall and remote-access box made by Fortinet that many companies use to let staff log in from home. Researchers found that 86,644 passwords for these devices had been stolen. British and American cyber-security agencies knew about the theft in June but treated it as a private matter rather than a public warning. A criminal group called Lynx, which also goes by INC Ransom, is now accused of cracking those passwords using 45 powerful graphics cards of the kind used for gaming, chained together to guess them fast. The problem is that Fortinet stored the passwords in an old, weak format that makes guessing far easier than it should be. Anyone still using one of the leaked logins could have their network broken into.

Deep Analysis
Root Causes

Fortinet has never forced a password reset across its FortiGate install base when hashing weaknesses surface, because a mass reset would sever SSL-VPN sessions for every customer at once; the vendor treats reset campaigns as a continuity risk rather than a security obligation, leaving legacy SHA-256 hashes live on firmware branches still under support.

Many FortiGate SSL-VPN portals authenticate straight against on-premises Active Directory without enforcing multi-factor login on the VPN hop itself, a configuration Fortinet's own hardening guides discourage but do not block by default. A cracked portal password on this class of device can open a route straight to the domain controller, well beyond the firewall it was meant to guard.

Escalation

Lynx/INC Ransom's usual pattern, per Recorded Future's ransomware tracking, runs two to six weeks from initial access to deploying an encryptor. Any organisation with an unreset leaked password may already be inside that window without knowing it.

What could happen next?
  • Risk

    Any organisation that reused a FortiGate SSL-VPN password included in the 86,644-credential set remains exposed until it forces a reset, regardless of whether Lynx/INC Ransom or another buyer holds the cracked list.

  • Precedent

    The six-week gap between the June private flag and July's public cracking claim will likely sharpen debate over when agencies should convert a privately held credential warning into a public one.

Sources:BleepingComputer
Mentions:SOCRadar →Fortinet →NCSC →CISA →Samsung Electronics →Siemens →Oracle →Accenture →Infosys →Foxconn →FortiBleed →INC Ransom →
First Reported In

Update #9 · FortiBleed harvest linked to Lynx crew

BleepingComputer· 4 Jul 2026
Read original →
Causes and effects
Caused by
86,644 Fortinet logins become a hit list
The FortiBleed credential harvest privately flagged in June is now confirmed exploited by the Lynx/INC Ransom crew.
Occurred 18 Jun 2026
Read story →
This Event
Lynx crew cashes in FortiBleed haul
A credential set flagged as privately held in June now sits with a ransomware crew that authenticates rather than exploits, so rotation, not patching, is the only reset.
Led to
One operator ran both ransomware brands
The provisional Lynx attribution from 1 July now rests on a shared negotiation-panel operator rather than tooling overlap alone.
Occurred 8 Jul 2026
Read story →
CISA's KEV list runs a month late
SOCRadar's attribution of the FortiGate credential harvest to Lynx and INC Ransom is part of the same Fortinet exposure thread FortiSandbox now extends.
Occurred 16 Jul 2026
Read story →
Different Perspectives
ENISA
ENISA
ENISA published an SME cyber-resilience maturity model on 6 August and updated the Cyber Resilience Act reporting-platform FAQ on 31 August. The agency supplies common implementation tools for smaller operators, but it cannot fine organisations that do not use them.
UAE Cyber Security Council
UAE Cyber Security Council
On 10 August, the UAE Cyber Security Council said national teams contained attacks on aviation, energy and education before objectives were reached. Its second monthly statement, after a 3 July financial-sector disclosure, makes public reporting of stopped attacks part of its operating posture.
South African authorities
South African authorities
INTERPOL said on 25 August that South African authorities made 39 arrests, seized US$2.67 million and blocked 257 accounts during Operation Jackal IV. Their share of the 23-country operation shows the material enforcement burden in a cross-border fraud case.
Europol
Europol
On 2 September, Europol announced the sinkholing of Sality after a 31 August operation involving US, Bulgarian, Hungarian and Romanian authorities. Its more than 11 million linked IP addresses measure infrastructure contact, not confirmed victims, and show why technical partners joined the action.
CISA
CISA
From 3 August to 2 September, CISA recorded three-day deadlines for 24 of 37 KEV additions, compared with 34 of 39 from 10 June to 29 July. The falling share changes the urgency signal that US federal agencies and private-sector tooling draw from the catalogue.
Beacon
Beacon
On 3 September, Beacon said its final report found that an intruder likely exported its customer database during roughly one hour and 27 minutes on 27 July. Charities using the CRM now have a named exposure route, a compromised AWS access key in public build artefacts.