Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
Cybersecurity: Threats and Defences
5SEP

Lynx crew cashes in FortiBleed haul

3 min read
12:09UTC

SOCRadar tied the 86,644-credential FortiGate harvest to the Lynx ransomware crew, which cracked legacy passwords offline on a 45-GPU rig rather than exploiting any flaw.

← Back to Four privileged platforms under live attackJump to analysis ↓
TechnologyDeveloping
Key takeaway

Rotation, not patching, resets a FortiGate estate once Lynx has cracked its stored credentials.

SOCRadar, a threat-intelligence firm, has attributed the theft of 86,644 Fortinet FortiGate firewall credentials to the Lynx/INC Ransom ransomware operation, the company said this week. The set was flagged by Britain's National Cyber Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA) on 18 June as privately held; SOCRadar assesses the crew has run it since at least February 2026. Lynx needs no software exploit to use it. It logs in. Named in the exposed set are Samsung, Siemens, Oracle, DHL, Accenture, Infosys and Foxconn.⁠1

Lynx cracked the passwords offline on a 45-GPU Hashtopolis cluster, a rig of 45 graphics processors coordinated to test guesses at speed, working against legacy FortiOS credentials still stored as SHA-256 hashes. Fortinet's 2025 upgrade re-hashed stored credentials to PBKDF2, but estates that skipped the upgrade never made the switch. SHA-256 computes fast, so a graphics-card rig can test billions of guesses a second against a stolen hash; PBKDF2 deliberately runs each guess through thousands of iterations, which is what makes an offline crack uneconomic.

Because the cracking ran on Lynx's own hardware, no failed-login telemetry appeared on any victim device. The first thing a defender sees is a successful login with a valid credential, not a brute-force spike. For the seven named blue-chips, that inverts the usual detection assumption and leaves credential rotation, not a patch, as the only clean reset.

Deep Analysis

In plain English

A FortiGate is a firewall and remote-access box made by Fortinet that many companies use to let staff log in from home. Researchers found that 86,644 passwords for these devices had been stolen. British and American cyber-security agencies knew about the theft in June but treated it as a private matter rather than a public warning. A criminal group called Lynx, which also goes by INC Ransom, is now accused of cracking those passwords using 45 powerful graphics cards of the kind used for gaming, chained together to guess them fast. The problem is that Fortinet stored the passwords in an old, weak format that makes guessing far easier than it should be. Anyone still using one of the leaked logins could have their network broken into.

Deep Analysis
Root Causes

Fortinet has never forced a password reset across its FortiGate install base when hashing weaknesses surface, because a mass reset would sever SSL-VPN sessions for every customer at once; the vendor treats reset campaigns as a continuity risk rather than a security obligation, leaving legacy SHA-256 hashes live on firmware branches still under support.

Many FortiGate SSL-VPN portals authenticate straight against on-premises Active Directory without enforcing multi-factor login on the VPN hop itself, a configuration Fortinet's own hardening guides discourage but do not block by default. A cracked portal password on this class of device can open a route straight to the domain controller, well beyond the firewall it was meant to guard.

Escalation

Lynx/INC Ransom's usual pattern, per Recorded Future's ransomware tracking, runs two to six weeks from initial access to deploying an encryptor. Any organisation with an unreset leaked password may already be inside that window without knowing it.

What could happen next?
  • Risk

    Any organisation that reused a FortiGate SSL-VPN password included in the 86,644-credential set remains exposed until it forces a reset, regardless of whether Lynx/INC Ransom or another buyer holds the cracked list.

  • Precedent

    The six-week gap between the June private flag and July's public cracking claim will likely sharpen debate over when agencies should convert a privately held credential warning into a public one.

Sources:BleepingComputer
Mentions:SOCRadar →Fortinet →NCSC →CISA →Samsung Electronics →Siemens →Oracle →Accenture →Infosys →Foxconn →FortiBleed →INC Ransom →
First Reported In

Update #9 · FortiBleed harvest linked to Lynx crew

BleepingComputer· 4 Jul 2026
Read original →
Causes and effects
Caused by
86,644 Fortinet logins become a hit list
The FortiBleed credential harvest privately flagged in June is now confirmed exploited by the Lynx/INC Ransom crew.
Occurred 18 Jun 2026
Read story →
This Event
Lynx crew cashes in FortiBleed haul
A credential set flagged as privately held in June now sits with a ransomware crew that authenticates rather than exploits, so rotation, not patching, is the only reset.
Led to
One operator ran both ransomware brands
The provisional Lynx attribution from 1 July now rests on a shared negotiation-panel operator rather than tooling overlap alone.
Occurred 8 Jul 2026
Read story →
CISA's KEV list runs a month late
SOCRadar's attribution of the FortiGate credential harvest to Lynx and INC Ransom is part of the same Fortinet exposure thread FortiSandbox now extends.
Occurred 16 Jul 2026
Read story →
Different Perspectives
Hospital Sírio-Libanês
Hospital Sírio-Libanês
Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.
The Foschini Group
The Foschini Group
The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.
FirstVDS
FirstVDS
FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.
ESET
ESET
ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.
JPCERT/CC
JPCERT/CC
JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.
Cyber Security Agency of Singapore
Cyber Security Agency of Singapore
The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.