The IT Nerd

After announcing last week that SOCRadar Links FortiBleed Campaign to INC and Lynx Ransomware Operations, today the SOCRadar Threat Research Unit (STRU) published its complete report that reveals exactly how INC and Lynx used a measurable, tracked spend on AI credits, an entire swarm of autonomous agents pointed at one target with a deliberate model-selection strategy (cheap model for high-volume scanning, a frontier model reserved for deep code review), and active jailbreak research to defeat model safety controls.

Today’s complete report also puts an identity and a profile behind the coordinating operator and lays out the full internal hierarchy by role.  

Key points:

• Attribution: STRU assesses with high confidence that FortiBleed is a joint operation run by affiliates of the Lynx and INC ransomware groups.
• How they know: an OPSEC failure exposed the group’s own artifacts, including a single Windows workstation used to access both ransomware panels and negotiate ransoms. A second exposed INC directory shared victims with FortiBleed target lists, and Lynx is widely believed to be an evolved variant of INC.
• The operator: an actor we track as TOXMAN (also TOXFOX, and Greenprawn100 on the Exploit[.]in forum), with Russian-language tooling and activity in the UTC +3 time zone.
• Organized like a business: an internal tracking file mapped 20+ affiliates in defined roles, backed by 450+ operational servers.
• Scale: roughly 11,250 FortiGate portals scanned across 150+ countries, leading to 409 administrative accesses and 12 organizations encrypted for ransom.
• Heavy AI investment: about $4,554 spent on AI model credits, including 14 autonomous AI agents pointed at a single target, jailbreak use to bypass model safety controls, and a likely zero-day now in responsible disclosure.
• Quiet by design: default admin credentials and a VPN-to-management pivot turn one firewall login into full domain compromise, and because the logins are real they rarely trip a perimeter alarm.
• Who is targeted: opportunistic, small-to-mid-market firms, with managed service providers and manufacturers prized for lateral access into their customers.

For full details, please see the new report: FortiBleed Unmasked: A Joint Operation by Lynx and INC Ransomware Group. A pdf of the report can be found here.  

SOCRadar’s Threat Research Unit (STRU) has linked the FortiBleed credential-harvesting campaign to two active ransomware-as-a-service operations, INC Ransom and Lynx, making the exposure much more significant (see post SOCRadar Links FortiBleed Campaign to INC and Lynx Ransomware Increasing Exposure).

An operator tied to FortiBleed’s infrastructure was found actively working negotiation panels for both groups, tying mass FortiGate credential theft directly to ransomware deployment for the first time.

Behind the credential leaks lies a coordinated operation run by the Lynx-INC ransomware group, and the actors are exploiting a previously undisclosed Nextcloud zero-day that our team is actively investigating.

The operators were found leveraging a Nextcloud zero-day to expand access. Investigation is ongoing – full technical details, affected versions, and IOCs will follow in our upcoming report.

Key findings:

• FortiBleed has targeted 430,000+ FortiGate firewalls worldwide via a custom credential-sniffing tool
• STRU identified 200+ additional operational servers beyond the original campaign
• An operator with access to FortiBleed infrastructure was found logged into both INC Ransom and Lynx negotiation panels
• Victim data from FortiBleed overlaps with victims already tracked by INC Ransom
• An internal tracking document reveals an organized, ~20-person operation with a clear division of labor

What we now know

• Ransomware operation: STRU assesses with high confidence that FortiBleed is operated by the Lynx-INC ransomware group. Extensive intelligence has been obtained on the group, including its members.
• Nextcloud zero-day: The actors are exploiting a previously undisclosed Nextcloud zero-day. Our analysis is ongoing.
• Backdoored accounts: Persistent backdoor accounts were found on compromised devices (username: adminin).
• Large-scale sniffing: Traffic sniffing was identified on ~19,000 Fortinet devices. Following SOCRadar’s notifications to affected parties, this number has dropped to ~11,000.
• Infrastructure seizure: 500 servers were seized – including the server Lynx-INC used for ransom negotiations.
• Decryption: Efforts to recover decryption keys are ongoing.

Recent timeline

• 29 Jun 2026 – 9,426 newly identified FortiGate devices found in Lynx-INC’s internal tracking documents, with ransomware deployed against several targets.
• 27 Jun 2026 – FortiBleed formally linked to the Lynx-INC ransomware group.
• 26 Jun 2026 – IoC update: 42 operation servers and 13 files added.
• 25 Jun 2026 – Citrix target list discovered: 29,000 IP addresses and 37 domains, indicating targeting is expanding beyond FortiGate.
• 25 Jun 2026 – IoC update: 19 operation servers and 4 files added.

A detailed report – covering the Lynx-INC operation, the Nextcloud zero-day, and full indicators of compromise will be published later this week or early next week.

The SOCRadar Threat Research Team, among the first to identify and analyze the FortiBleed leak, has opened its research to the public, having already alerted thousands of customers and national CERTs — and invites every government cybersecurity agency to coordinate on the data.

Over the past 24 hours the company’s Threat Research team has reconstructed the full attack chain behind the campaign, validated the exposed records, and proactively notified thousands of affected customers as well as the local and national CERTs it works with. With those stakeholders already informed, SOCRadar is now making its analysis available to everyone.

SOCRadar also announced the public release of its free FortiBleed Exposure Checker, a tool that lets any organization instantly verify whether its IP Addresses or Domains appear in the FortiBleed dataset — one of the largest known collections of compromised Fortinet credentials.

To view the extended dataset and use the free FortiBleed Exposure Checker, have a look at this link: FortiBleed Exposure Checker 

SOCRadar’s researchers have discovered a threat actor systematically compromising Fortinet firewalls and VPN gateways on a massive, global scale, silently building a verified database of working credentials across 194 countries with the US as the #2 target.

The attacker’s database contains login credentials for more than 30,791 devices belonging to companies, banks, telecom operators, hospitals, universities, government agencies, energy companies and multinational corporations with revenues in the tens of billions of dollars. Government entities alone account for 591 entries across 111 domains. Telecoms represent one of the most heavily targeted sectors with 5,616 entries.

The credentials are verified, working usernames and passwords, tested and confirmed by the attackers themselves using automated tools running around the clock. The credentials were leaked from Fortinet devices in earlier incidents, meaning many targets may have never changed their passwords after a prior breach. The attackers know this, and they are counting on it.

The operation is built around full automation. The attackers scan the internet for Fortinet devices, try a curated list of known passwords against each one, and record every successful login. Once a device is compromised, they use it as a listening post, monitoring traffic passing through and collecting any additional credentials that flow by. Those freshly collected passwords are then fed back into the scanner to compromise even more devices. The system feeds itself.

To view the research, please see FortiBleed: How 30,000 Fortinet Firewalls Exposed Corporate Networks Quietly 

The SOCRadar Threat Research team has uncovered an active Malware-as-a-Service (MaaS) and Phishing-as-a-Service (PhaaS) operation active since 2025 by developer “RockyBelling,” who supplies phishing kits, cloaking services, remote management tooling, and supporting infrastructure to nearly 200 operators conducting independent campaigns.

The report The Quarry: Tracing a Cybercriminal Operation analyzes the complete attack chain, including bulk email distribution, tax-themed phishing campaigns impersonating government agencies and major software providers, traffic cloaking through Adspect, deployment of remote monitoring and management (RMM) tools, Telegram-based victim monitoring, and post-compromise activities. It also examines infrastructure patterns, attribution findings, victimology, and operational techniques used to evade detection while scaling attacks across multiple regions and sectors.

Key Highlights:

• Detailed analysis of a large-scale MaaS and PhaaS ecosystem operating since at least 2025
• Attribution of the operation’s developer, infrastructure, and affiliate network
• Breakdown of the complete attack lifecycle from phishing to post-exploitation
• Examination of cloaking, traffic filtering, and anti-analysis techniques
• Analysis of phishing lures impersonating government agencies and major brands
• Insights into Telegram-based operations, infrastructure management, and affiliate activity
• Victimology, geographic targeting, sector distribution, and observed TTPs
• Indicators of Compromise (IoCs) and defensive recommendations for security teams

Have a look at the report The Quarry: Tracing a Cybercriminal Operation.

On the same day that Iran and Israel traded missile strikes in their most serious exchange since the April ceasefire, Iranian-linked hacker group Handala posted a series of messages on Telegram claiming it had launched crippling cyberattacks against Israeli military and civilian targets. The claims include “widespread and targeted signal disruption” of Israeli radar systems and a “cyber siege” on the Kfar Yona municipality in central Israel.

The messages opened with “In the name of God, the Breaker of Tyrants” in Arabic. Five minutes later came the main statement: “Today marks the beginning of the end. Handala invites you to witness the most devastating cyberattacks targeting the enemy’s military and vital infrastructure, and this is only the first warning.” The message threatened every country that supports Israel, saying “no land is too distant, no server is safe, and no network is out of reach.”

The group claimed that “at this very moment, the radar systems of the Zionist regime are experiencing widespread and targeted signal disruption by Handala’s team.” Handala then shifted to a governmental target, claiming the Kfar Yona Municipality was “under Handala’s cyber siege, drowning in a storm of digital paralysis and information chaos.”

In a new SOCRadar report published today, the company’s security researchers warn that the radar claim should be treated with caution as the evidence shared so far does not support it, including no proper details posted, and many other specifics shared in the SOCRadar report.

The details on the new SOCRadar report is here: Handala Claims It Disrupted Israeli Radar Systems: Here’s What We Actually Know

SOCRadar today launched Hacker Score, a new tool designed to help Managed Security Service Providers (MSSPs) and Managed Service Providers (MSPs) garner immediate trust with prospects by showing them where they are vulnerable using automated external exposure checks in order to generate leads. Available free of charge for a limited time, Hacker Score delivers an instant score of a prospect’s digital footprint, identifying vulnerabilities, leaked credentials, and surface/dark web exposures without a complex set up.

MSSPs and MSPs continue to struggle with the manual, time-consuming process of conducting initial security assessments for prospects. Standard “scans” often lack the depth of Extended Threat Intelligence (XTI), making it difficult for them to differentiate their services from their competitors and prove the necessity of their security stack in a crowded market.

Hacker Score helps organizations see themselves through the eyes of an attacker. By continuously monitoring more than 150 indicators and attack vectors that hackers typically evaluate before launching an attack, Hacker Score reveals what adversaries already know about an organization. Combining attack surface intelligence with SOCRadar’s deep and dark web datasets, including stealer logs, compromised credentials, ransomware intelligence, and phishing infrastructure, Hacker Score delivers a real-world assessment of organizational exposure and highlights the weaknesses most likely to be targeted.

Hacker Score’s features include:

• External Attack Surface Mapping: Provides visibility into all internet-facing assets.
• Credential Leak Detection: Identifies employee data exposed in recent breaches or stealer logs.
• Vulnerability Assessment: Instantly identifies critical, exploitable vulnerabilities across a prospect’s infrastructure.
• Supply Chain Risk: Evaluates the risk levels of a prospect’s third-party ecosystem.

SOCRadar is proud to announce it has been named to Inc.’s 2026 Best Workplaces list and recognized in the Security industry category. The list, which can be found at Inc.com,honors American companies that have built exceptional workplaces and vibrant cultures that support their teams and businesses, whether in-person, remote, or hybrid.

The award is the result of comprehensive measurement and evaluation of hundreds of applicants. The process involved a detailed employee survey conducted by Quantum Workplace, covering critical elements such as management effectiveness, perks, professional development, and overall company culture. Each company’s benefits were also audited to determine the overall score. SOCRadar is honored to be included among the 507 companies recognized this year.

SOCRadar is one of the fastest growing cybersecurity companies in the world with a significant global footprint of customers in 150+ countries. Its Extended Threat Intelligence Platform leverages AI and machine learning to enhance threat detection and deliver actionable intelligence that helps businesses proactively defend against cyber attacks. As a pioneer delivering advanced threat intelligence solutions, SOCRadar’s mission is to fortify organizational defenses, mitigate external risks, and foster a safer digital ecosystem worldwide.

To view the full list of winners, visit Inc.com.

According to new analysis by the SOCRadar threat intelligence team, B1ack’s Stash, one of the most active illicit card shops on the Dark Web, has announced the free release of approximately 4.6 million stolen credit card records, this time framing it as a response to seller misconduct on its own platform.

Through a forum post targeting the criminal underground, B1ack Stash recently declared the suspension of approximately 8 million stolen CVV2 records from its active inventory. The stated reason: sellers on the platform had been reselling cards purchased from B1ack’s Stash in competing shops, violating the marketplace’s internal rules. Rather than simply removing the affected cards, the operator/s behind the marketplace chose to release approximately 4.6 million of them as a free download, directing users to the marketplace’s Freebies section.

The leaked data, appearing to be sourced from e-commerce skimming or phishing operations, includes: 

1. Full credit/debit card numbers
2. Expiration dates
3. CVV2 code
4. Cardholder’s full name
5. Billing address
6. Email address
7. Phone number
8. IP address

SOCRadar’s analysis found the records consistent with genuine compromise data, passing BIN and algorithm checks. After filtering duplicates, expired cards, and previously known entries, an estimated 4.3 million cards appear to be net new and potentially actionable. SOCRadar’s validation of the dataset is ongoing.

For full details on this leak, including geographical breakdown, and threat actor breakdown, the analysis can be read here: https://socradar.io/blog/b1acks-stash-4-6-million-stolen-credit-cards-free/

SOCRadar, a global leader in extended threat intelligence and cybersecurity, today announced it has been named a Visionary in the 2026 Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies, which helps leaders evaluate the right CTI technologies against the most impactful threats. This is the first time SOCRadar has been evaluated and ranked by Gartner.

According to Gartner, SOCRadar’s agentic Extended Threat Intelligence Platform is a unified system that brings together digital risk protection, threat intelligence, and attack surface monitoring. The platform serves enterprises, MSSPs, and government organizations that need visibility across surface, deep, and dark web, enriched with identity, brand, infrastructure, and vulnerability intelligence. As well, the Gartner report highlights the SOCRadar MCP Server and SOCRadar Copilot for AI-driven insights, adversary attribution, alert prioritization, supply chain risk analysis, and phishing detection through modular agent-based logic.

To gain free access to the full Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies report, please see this link.