"An operator tied to FortiBleed's infrastructure was found actively working negotiation panels for both groups, tying mass FortiGate credential theft directly to ransomware deployment for the first time," SOCRadar said in a new report published Wednesday.
SOCRadar's forensic trail
SOCRadar’s report lays out a chain of activity linking a mass credential-harvesting campaign dubbed FortiBleed to multiple ransomware outcomes. Analysts tracked scanning activity against roughly 11,250 FortiGate portals across more than 150 countries, confirmed admin-level access on 409 targets, and observed the full attack chain completed on 354 of those systems. At least 12 ransomware deployments have been attributed to access gained through this operation, with "hundreds of endpoints" encrypted across affected organizations, the firm reported.
Scale of the harvest: 430,000 FortiGate firewalls and 110 million credentials
The campaign is assessed to have targeted 430,000 FortiGate firewalls globally and to have gathered over 110 million credentials. Attackers systematically scanned the internet for exposed Fortinet devices, attempted credential combinations, and deployed custom packet sniffers to passively collect credentials and other authentication data from network traffic. SOCRadar estimates the Golang sniffer was installed on about 12,000 Fortinet devices — a substantial subset of the total devices targeted. The operation was exposed after the attackers left a server containing credentials stolen from thousands of Fortinet appliances accessible on the internet.
Direct links to INC Ransom and Lynx ransomware operations
SOCRadar reports that one of roughly 200 newly discovered servers tied to FortiBleed yielded internal files, logs, and operational documentation that allowed a clearer view of the operation. Those artifacts show an operator with access to FortiBleed infrastructure logged into negotiation panels for both INC Ransom and Lynx. Victim listings managed by INC Ransom overlapped with data recovered from the campaign, creating a direct attribution between the credential harvest and follow-on ransomware deployment, according to the report.
Operator profile, organization, and targeting
Tooling, logs, and working-hour patterns indicate the activity is the work of a Russian-speaking threat actor who likely functions as an initial access broker. SOCRadar said it discovered internal documentation portraying an organized group of roughly 20 people with a clear division of labor: "A small core of lead operators drives most high-impact intrusions, backed by specialists and support staff." Much of the targeting singled out manufacturing, technology, and logistics sectors in Latin America and the Asia Pacific regions.
Related exploitation: FortiClient EMS CVE-2026-35616 and EKZ Stealer
Separately, eSentire reported observing threat actors exploiting a flaw in Fortinet FortiClient EMS identified as CVE-2026-35616 (CVSS score: 9.1) to deploy an information stealer named EKZ Stealer against a customer in the energy, utilities, and waste sector. eSentire said the end goal of that activity was to harvest credentials from Chromium-based browsers and Firefox and to exfiltrate them via PowerShell. That observation runs alongside SOCRadar’s findings, highlighting multiple contemporaneous techniques to collect credentials from network and endpoint vectors.
What this means for technologists, affected enterprises, and procurement leaders
- Technologists and security teams: The FortiBleed findings illustrate how credential harvesting at scale can be chained to ransomware negotiations. Teams responsible for device inventory, monitoring of FortiGate portals, and detection of unauthorized sniffers will be directly implicated by SOCRadar’s indicators and timelines.
- Affected enterprises (manufacturing, technology, logistics, energy/utilities/waste): The sectors named by SOCRadar and eSentire should expect targeted reconnaissance and potential follow-on intrusions. The report’s linkage between stolen FortiGate credentials and confirmed ransomware deployments underscores the operational risk from exposed network infrastructure and browser-credential theft alike.
- Procurement leaders and vendors (including Nextcloud): SOCRadar said the actors are believed to possess at least one zero-day in Nextcloud and that the firm is coordinating with the affected vendor. Procurement and vendor-risk teams will need to track vendor advisories and coordinated disclosures tied to both Fortinet and Nextcloud vectors.
The FortiBleed disclosures stitch together a single narrative: widespread, automated credential harvesting; tooling to capture authentication data in-flight; an organized brokered operation moving harvested access onto ransomware negotiation panels; and parallel endpoint-focused theft leveraging a separate FortiClient EMS flaw. SOCRadar’s access to an operational server and eSentire’s endpoint observation give concrete timestamps and artifacts to that chain — and leave a pointed question for defenders and vendors alike: how many stolen credentials have yet to be used, and how quickly can coordination between intelligence providers and affected vendors blunt further exploitation?
