Loading threat actor…
Lynx/INC is a ransomware and extortion threat actor assessed with moderate confidence to be linked to the operators behind the FortiBleed credential-compromise campaign. Reporting has tied the actor to a financially motivated, Russian-speaking cluster and to activity consistent with an initial access broker supporting ransomware operations. The group has been associated with large-scale targeting of internet-facing Fortinet FortiGate firewalls and SSL VPN gateways through credential reuse, credential stuffing, and brute-force attacks rather than exploitation of a new Fortinet vulnerability. Activity attributed to this cluster includes automated harvesting of administrator and VPN credentials at global scale, deployment of a Golang-based credential-capture utility on compromised FortiGate devices, collection of session cookies and other authentication material from network traffic, offline cracking of exported password hashes, and reuse of harvested credentials for follow-on intrusion activity. The operation has also been described as targeting telecommunications providers and managed service providers as pathways into downstream victim environments, with evidence in some cases of internal directory-service access and lateral movement after perimeter compromise. Lynx/INC has been referenced in ransomware victimology reporting as an active ransomware group during 2025, ranking among the more frequently encountered operations in incident-response caseloads. Available reporting also indicates overlap between Lynx and INC branding and infrastructure, but the precise organizational relationship, including whether they are the same group, a merged operation, or closely cooperating affiliates, is not fully resolved in the supplied facts. High-confidence characterization supports describing the actor as a financially motivated ransomware and credential-theft operation with capabilities spanning initial access, credential harvesting, session theft, lateral movement, data theft, and extortion.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Potentially linked to the FortiBleed credential-compromise campaign and possible downstream ransomware deployment, but attribution is described as pending further analysis.
Attributed to a credential database tied to the FortiBleed campaign, involving exposed and sold login credentials for organizations including UK government entities.
Attributed as the threat actor behind the ongoing FortiBleed campaign, which targets internet-facing Fortinet VPNs and firewalls and harvests exposed login credentials at scale for sale on the dark web.
Ranked third among the most active ransomware groups discussed in the report.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.