Lynx (Malware): news timeline & CVEs

FBI: FortiBleed attackers can lock organizations out of their own firewalls

FBI says FortiBleed operators hit over 80,000 FortiGate devices and can lock victims out of firewalls.

The FBI and U.S. Secret Service examined backend infrastructure behind the ongoing FortiBleed campaign, which has already affected more than 80,000 devices worldwide. Operators stole Fortinet credentials, cracked password hashes offline with rented GPUs, Hashcat, and Hashtopolic, then created administrative accounts on FortiGate firewalls and sometimes deleted legitimate accounts to lock organizations out. The FBI said attackers enumerated Active Directory, moved laterally with stolen credentials, and offered access to ransomware affiliates including INC/Lynx and Payload. Investigators also found command-and-control servers, relays, and scanning hosts, and published account names and IP indicators.

CSO OnlineOct 8, 11:44 UTC · 13h agoThreat actor in the wild 13 sources

FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins

FBI says ongoing FortiBleed attacks still lock FortiGate VPN admins out using leaked and cracked credentials.

The FBI warned that FortiBleed attacks remain active against exposed Fortinet FortiGate firewalls and SSL VPN gateways, with intruders locking out legitimate administrators. Attackers use previously leaked credentials, infostealer logs, credential stuffing, and password spraying, then crack stolen hashes offline with a distributed GPU cluster running Hashcat and Hashtopolis. A June exposure contained usernames and plaintext passwords for 73,932 firewall URLs in 194 countries; SOCRadar later counted 86,644 compromised devices and tied the activity to INC/Lynx and Payload ransomware affiliates. The FBI said actors create new admin accounts, delete or reset existing ones, persist, move laterally, and package VPN access for sale, and advised MFA, session termination, log review, and PBKDF2 password storage.

BleepingComputerupdated Oct 8, 11:44 UTC · 13h agofirst Oct 7, 21:28 UTC · 1d agoThreat actor in the wild 13 sources

FortiBleed Attack Campaign Exploiting Fortinet Firewalls and VPNs – FBI Warns

FBI warns FortiBleed compromised over 86,000 Fortinet firewalls and VPNs in 194 countries.

The FBI and U.S. Secret Service warned that the ongoing FortiBleed campaign is compromising internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, reportedly affecting more than 86,644 devices across 194 countries. It is not a single new Fortinet vulnerability: operators reuse leaked or weak credentials, crack legacy SHA-256 hashes, and sell verified access. After entry they may create administrator accounts, disable or delete legitimate admins, and enumerate Active Directory. The advisory links the activity to initial-access brokers supporting INC/Lynx and Payload ransomware.

Cyber Security Newsupdated Oct 8, 11:44 UTC · 13h agofirst Oct 7, 13:19 UTC · 1d agoThreat actor in the wild 13 sources1

FBI, Secret Service add to warnings of FortiBleed credential stealing campaign

FBI and Secret Service say FortiBleed compromised over 86,000 Fortinet firewalls in 194 countries.

The FBI and Secret Service warned that the ongoing FortiBleed campaign has compromised more than 86,000 internet-facing Fortinet FortiGate firewalls and VPN gateways across 194 countries using reused or leaked credentials. Operators scanned exposed SSL VPN portals, ran credential stuffing and password spraying, validated stolen logins, and created new accounts on firewalls. Initial access brokers offered that access to ransomware affiliates tied to INC/Lynx and Payload, and at least 12 organizations were encrypted. CISA and UK officials had warned earlier, and Russian operators were alleged to have used the campaign against UK government email.

The Recordupdated Oct 8, 11:44 UTC · 13h agofirst Oct 7, 12:50 UTC · 1d agoThreat actor in the wild 13 sources1

Lynx

Timeline4 articles

Appears with

FBI: FortiBleed attackers can lock organizations out of their own firewalls

FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins

FortiBleed Attack Campaign Exploiting Fortinet Firewalls and VPNs – FBI Warns

FBI, Secret Service add to warnings of FortiBleed credential stealing campaign