FortiBleed Campaign: Active INC Ransom and Lynx Exploitation of FortiGate Devices

---
title: Potential INC Ransom or Lynx Ransomware Process Activity
id: 8a4b2c1d-9e6f-4a3b-8c2d-1e4f5a6b7c8d
status: experimental
description: Detects suspicious process execution patterns often associated with INC Ransom and Lynx operations, including usage of tools for mass file encryption and system disabling.
references:
  - https://securityaffairs.com/194645/security/430000-fortigate-devices-exposed-in-fortibleed-ransomware-link.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection_main:
    Image|endswith:
      - '\rundll32.exe'
      - '\powershell.exe'
      - '\cmd.exe'
  selection_cli:
    CommandLine|contains:
      - ' -enc '
      - 'vssadmin delete shadows'
      - 'wbadmin delete catalog'
      - 'bcdedit /set'
  condition: all of selection_*
falsepositives:
  - Legitimate system administration scripts
level: high
---
title: FortiGate Administrative Login Anomaly
id: 9c5d3e2f-1a7b-4c8d-9e0f-2a3b4c5d6e7f
status: experimental
description: Detects successful administrative logins to FortiGate devices which may indicate the use of credentials harvested by the FortiBleed campaign.
references:
  - https://securityaffairs.com/194645/security/430000-fortigate-devices-exposed-in-fortibleed-ransomware-link.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  category: firewall
  product: fortinet
detection:
  selection:
    action: 'admin-login'
    result: 'success'
  filter:
    src_ip|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection and not filter
falsepositives:
  - Legitimate remote administration from trusted external IPs
level: medium

// Hunt for FortiGate Admin Logins followed by suspicious internal activity
let FortiLogins =
Syslog
| where Facility contains "fortinet" or SyslogMessage contains "action=admin-login"
| parse SyslogMessage with * "user=" User " " * "srcip=" SrcIP " " * "result=" Result
| where Result == "success"
| project TimeGenerated, User, SrcIP, Message;
// Correlate with endpoint suspicious processes (assuming DeviceProcessEvents or SecurityEvent data)
let SuspiciousProcesses =
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has "vssadmin delete shadows" 
   or ProcessCommandLine has "wbadmin delete catalog" 
   or ProcessCommandLine has " -enc "
| project Timestamp, DeviceName, AccountName, ProcessCommandLine;
// Join to see if admin IPs are seen interacting with endpoints or if temporal proximity suggests rapid movement
FortiLogins
| join kind=inner SuspiciousProcesses on $left.TimeGenerated <= $right.Timestamp + time(1hour)
| project TimeGenerated, User, SrcIP, DeviceName, AccountName, ProcessCommandLine
| distinct TimeGenerated, User, SrcIP, DeviceName, ProcessCommandLine

-- Hunt for ransomware indicators on endpoints
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe, 
  Username, 
  CreateTime
FROM pslist()
WHERE Name IN ('rundll32.exe', 'powershell.exe', 'cmd.exe')
  AND (
    CommandLine =~ 'vssadmin delete shadows' OR
    CommandLine =~ 'wbadmin delete catalog' OR
    CommandLine =~ ' -enc '
  )

-- Hunt for ransomware notes or encrypted files
SELECT FullPath, Size, Mtime
FROM glob(globs="C:\\*\\*.{inc,locked,lynx}")
WHERE Mtime > now() - 24h

<#
.SYNOPSIS
    Checks for Indicators of Compromise (IoC) related to INC Ransom/Lynx post-exploitation.
.DESCRIPTION
    This script scans event logs and running processes for evidence of shadow copy deletion,
    backup catalog destruction, and suspicious PowerShell execution often observed in 
    encryption-based attacks stemming from the FortiBleed campaign.
#>

Write-Host "[+] Starting hunt for INC Ransom/Lynx IoCs..." -ForegroundColor Cyan

# Check for Shadow Copy Deletion Events (VSSAdmin 1)
$vssEvents = Get-WinEvent -LogName Application -FilterXPath "*[System[(EventID=1)]] and *[Data[@Name='SourceName']='VSSAdmin']" -ErrorAction SilentlyContinue
if ($vssEvents) {
    Write-Host "[!] ALERT: VSSAdmin Shadow Copy Deletion detected." -ForegroundColor Red
    $vssEvents | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "[-] No VSSAdmin deletion events found." -ForegroundColor Green
}

# Check for Backup Catalog Deletion (wbadmin)
$wbadminFilter = @{LogName='Application'; ProviderName='wbadmin'}
$wbadminEvents = Get-WinEvent -FilterHashtable $wbadminFilter -ErrorAction SilentlyContinue | Where-Object { $_.Message -like '*delete*' }
if ($wbadminEvents) {
    Write-Host "[!] ALERT: WBAdmin catalog deletion detected." -ForegroundColor Red
    $wbadminEvents | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "[-] No WBAdmin deletion events found." -ForegroundColor Green
}

# Check for Suspicious PowerShell Encoded Commands
$processList = Get-Process -IncludeUserName | Where-Object { $_.ProcessName -eq 'powershell.exe' }
foreach ($proc in $processList) {
    try {
        $cmdLine = (Get-CimInstance Win32_Process -Filter "ProcessId = $($proc.Id)").CommandLine
        if ($cmdLine -match '-enc [A-Za-z0-9+/=]+') {
            Write-Host "[!] ALERT: Suspicious encoded PowerShell command detected in PID $($proc.Id) by user $($proc.UserName)." -ForegroundColor Red
            Write-Host "    Command: $cmdLine"
        }
    } catch {
        # Access denied or process ended
    }
}

Write-Host "[+] Hunt complete." -ForegroundColor Cyan