FortiBleed Actors Collaborating With Inc, Lynx Ransomware Gangs

SOCRadar research reveals that the FortiBleed initial access broker (IAB) campaign — which compromised thousands of Fortinet FortiGate firewalls using a Golang-based credential sniffer — is now collaborating with Inc Ransom and Lynx ransomware-as-a-service gangs. A single operator was found logged into both ransomware negotiation panels using infrastructure traceable to FortiBleed. The IAB has achieved admin-level access on 409 targets, with at least 12 confirmed ransomware deployments. Additionally, the FortiBleed group is exploiting an undisclosed zero-day vulnerability in Nextcloud to expand access. SOCRadar assesses the IAB as a structured ~20-person operation acting as an access-supply layer, with Inc and Lynx as downstream monetization channels.

Nguồn: https://www.darkreading.com/threat-intelligence/fortibleed-actors-inc-lynx-ransomware-gangs. 8sync News chỉ tóm tắt và dẫn link; bản quyền nội dung thuộc tác giả và nguồn gốc.

Đề xuất cho bạn

Security Boulevard0 Hot4 phút13 giờ trước

The Top 5 Misconceptions About Ransomware Recovery

Ransomware recovery is widely misunderstood as a simple technical restoration exercise. Five common misconceptions are examined: that backups alone equal cyber resilience, that the latest backup is the safest restore point, that absence of malware or IoCs means a snapshot is clean, that fast recovery is always good recovery, and that recovery is purely an IT problem. The core argument is that true recovery means restoring to a trusted state — addressing identity, persistence, attack pathways, and control gaps — not just getting systems back online quickly. A governance-driven model with defined recovery conditions, cross-team decision rights, and evidence-led confidence criteria is advocated over speed-first approaches.

#authentication#ransomware