SOCRadar links FortiBleed campaign targeting manufacturers to Lynx and INC ransomware attacks

The hacker likely already found and exploited a zero-day vulnerability in Nextcloud, an open-source content collaboration platform. They also built ‘PENTEST LAB,’ a Docker-based multi-agent AI framework based on CyberStrike, leveraging Large Language Model (LLMs) via OpenRouter API to autonomously research zero-day vulnerabilities on multiple open-source software such as Nextcloud, Keycloak and Guacamole.

The Threat Activity

The researchers also said they are investigating a suspected zero-day vulnerability affecting Nextcloud that may have been used during post-compromise activity.

Further details indicate that 3 out of 5 victims being present in the INC Ransom open directory could be correlated with FortiBleed: a Chinese manufacturer, a Japanese food wholesaler and a Taiwanese manufacturer.” The researchers noted that the hackers have different priorities depending on the country, with emerging markets serving as potential training grounds or testing grounds for their activities, which also provide a source of revenue and rapid intelligence, as oppo

TOXMAN was found to utilize AI for various steps of the attack chain, such as tool development, operations and vulnerability research.

Researchers said they identified an operator who had simultaneous access to FortiBleed infrastructure and ransomware negotiation panels of both groups, indicating that the credential theft campaign served as an initial access operation feeding downstream extortion attacks.

Scope & Targeting

SOCRadar documented 409 organizations where attackers obtained administrator-level access, with 354 organizations fully compromised and at least 12 confirmed ransomware incidents resulting in encryption of hundreds of endpoints. Similarly, the evidence provided insight into the attackers’ victimology, revealing increased targeting of organizations across Latin America and the Asia-Pacific region. The campaign primarily focused on manufacturing and technology organizations, reflecting a high-volume strategy aimed at small and mid-sized enterprises.

By leveraging critical operational security (OPSEC) failures in the group’s infrastructure management, it was possible to gain access to the threat actor’s artifacts.

SOCRadar documented 409 organizations where attackers obtained administrator-level access, with 354 organizations fully compromised and at least 12 confirmed ransomware incidents resulting in encryption of hundreds of endpoints.

Analysis

The incident highlights the continued pressure ransomware operators are placing on organizations worldwide.

Threat intelligence teams should add the described indicators of compromise to their detection rules, hunting playbooks, and SIEM correlation logic. Network defenders should monitor for the described tactics, techniques, and procedures across their environment, focusing on the MITRE ATT&CK techniques referenced in available reporting. Information sharing with industry partners, ISACs, and government agencies can accelerate collective response. Intelligence analysts should assess whether this activity overlaps with previously tracked threat actors or represents a new campaign. Strategic intelligence briefings should be prepared for leadership to communicate business risk and justify security investments.

Industry observers note that this type of development highlights the ongoing need for defense-in-depth strategies and proactive security posture management. Organizations that invest in regular security assessments and employee training tend to fare better when responding to emerging threats. The security community continues to share indicators and best practices to help defenders stay ahead.

Sources

1. https://industrialcyber.co/ransomware/socradar-links-fortibleed-campaign-targeting-manufacturers-to-lynx-and-inc-ransomware-attacks/