The FortiBleed campaign, which involves mass credential theft from Fortinet firewalls, has been directly linked to the INC and Lynx ransomware operations. An operator tied to FortiBleed’s infrastructure was observed working negotiation panels for both ransomware groups, indicating that the stolen credentials are being used for subsequent network intrusions and ransomware deployment. This connection highlights a direct pipeline from initial access to ransomware attacks.