Security researchers have linked the FortiBleed credential-theft campaign to two ransomware groups, suggesting that stolen FortiGate credentials are being used to enable ransomware attacks. The investigation, conducted by SOC Radar's Threat Research Unit, examined logs from hundreds of compromised Fortinet firewalls disclosed on June 17. An operational failure on a server allowed the team to view internal files and identify a user who accessed affiliate panels for both INC Ransom and Lynx ransomware groups. SOC Radar said this operator’s presence on both panels provides the clearest evidence that FortiBleed credentials are being handed off or used directly for ransomware deployment. STRU reported that at least 12 ransomware attacks have been traced to FortiBleed victims, though more than 70,000 successful attacks were initially reported. The analysis covered scans of 11,250 Fortinet portals and identified admin access on 409 targets, with 354 of those completing the full attack chain that compromised VPNs and domain controllers. Fortinet introduced the PBKDF2 algorithm for credential storage in early 2025, but the change took effect only after administrators logged back in, leaving many systems vulnerable to brute-force attacks. Organizations including FoxConn, Samsung, Comcast, Siemens, Lenovo, FedEx, PwC, Accenture and Oracle were among those listed in early reports. A Turkish NATO defense contractor was also identified after investigators found signs of classified file copies. The finding indicates that exposure to FortiBleed poses a credential risk and may lead to ransomware compromise. Researchers continue to monitor the infrastructure for further activity.