Article
Remote Access and IoT Search Engines
Arete Analysis
Recently, Arete Incident Response Tiger Teams (“Arete IR”) have responded to an increased volume of ransomware incidents involving the Sodinikibi, Phobos, and Dharma ransomware variants. The threat actors deploying these variants are known to use anti-forensics techniques to hide their tracks. Once access is gained, they usually delete artifacts which aid cyber investigators with reconstructing steps taken by the threat actors, revealing important information pertaining to the root cause for the computer security event. In most cases, Arete was able to recover critical artifacts to forensically reconstruct the various attacks to identify a single entry point consistent across the three variants: Remote Desktop.
Requirements Businesses have a need to enable workers to access files and business resources remotely from home, hotels, or business relationships. The cheapest way for businesses to allow remote access is to “expose” the Remote Desktop Protocol (“RDP”) to the public internet. The business’ firewall configuration is altered to allow inbound connectivity to the default port 3389, and any connections to that port are automatically forwarded to a specific computer on the network, which is usually a terminal services server. Using only an Internet Protocol (“IP”) address, anyone can attempt to connect to the RDP service.
Limitations on Protocol and Service Most businesses who implement remote access via RDP aren’t aware of the limitations of the service nor do they implement intrusion detection and prevention services. Lastly, many don’t require multi-factor authentication. The downside to allowing any connection into a network is exactly that: any connection can be allowed into the network. This connection can be from anywhere, at any time, for any reason and with any number of authentication attempts. The RDP service itself doesn’t monitor for bad credential combinations and automatically disable or block connection attempts. Port forwarding on firewalls doesn’t inspect the inbound traffic either. Essentially, once a port is exposed to the public internet, anyone, anywhere, can try an unlimited number of usernames and passwords to gain access to that system. Since any number of combinations can be attempted, this makes the configuration vulnerable to credential stuffing, dictionary, and brute force attacks.
Crime of Opportunity Quite often during our investigations, clients ask “was this a targeted attack or a crime of opportunity?” Nine out of 10 times, it’s a crime of opportunity. Then the follow up question “Why us?” Well, for starters, it’s your configuration. These threat actors have their attack mechanics down to a series of steps: 1. Identify target 2. Gain access to target 3. Cover tracks 4. Deploy ransomware 5. Repeat
While they most likely aren’t outright targeting your organization directly, they may be targeting exposed services which link them to your organization.
Internet of Things (IoT) Search Engines
Google, Bing, and DuckDuckGo are three very popular search engines. They’re used to find all sorts of text information or images. These search engines aren’t designed to identify specific computers or services across the world. Rather a different set of search engines can be used to find computers that are connected directly to the internet along with their IP addresses and any other information about the computer involving their geo location, running services, and protocol history. Use caution when visiting these sites as unintended side effects can occur.
https://zoomeye.org
These sites can be used by anyone, anonymously, to identify internet attached devices, the services they’re running and any other information the IoT crawlers can index. The anonymous feature is obtained via the IoT indexer by allowing anyone to query the index stored by the IoT search engine, instead of scanning the node directly. Essentially, this search engine is the phone book, allowing anyone to find street addresses by person’s names or people by street addresses.
A search for “port:3389”, which is the default port for RDP services, can return several million devices. Again, this isn’t real time information because the query is run against the index of the IoT search engine. Once an IP address is identified, additional steps would be needed to test if the IP address is online. Additionally, the resulting information can be filtered by organization, operating system, and country.
Reviewing the results, there’s approximately 1,060 IP addresses that are detected as the Windows 2003 operating system. At face value, this is extremely alarming because Windows 2003 was discontinued during July of 2015. Microsoft officially stopped supporting the operating system as well as providing security updates. Given the information returned from shodan.io, businesses are still relying on it as a means for remote connectivity. Again, these results would need to be qualified as online and available. Regardless, the number is still alarming.
Attack Methodologies
After the threat actor identifies a target, any number of steps can be performed to initiate an attack. Typically, the threat actor will profile the target to gain as much information as possible in order to increase the success of the attack. Profiling can occur in any of the following ways:
Verifying the IP address is online and attempting to brute force access automatically.
Attempting to resolve the IP address to a domain name or company name in order to:
Construct phishing emails for obtaining credentials.
Employ social engineering of employees for obtaining credentials
Research running services against known vulnerabilities to identify pre-built payloads to exploit the services.
Whichever approach the threat actor takes, there’s a good chance they will be successful with gaining unauthorized access to your network.
Preventative Actions
While it’s a waiting game to become the next victim, there are steps you can take to mitigate or prolong falling prey to these threat actor methodologies. Successful mitigation of unauthorized access can be achieved through the proper implementation of layered computer and network security controls. The following steps, while not exhaustive, can be taken to mitigate the exposure of services used by your organization.
Enable Multi-Factor Authentication (“MFA”) on any third party accounts or remote access on any third party accounts or remote access accounts. accounts.
Disable RDP services and port forwarding on firewalls.
Implement VPN services to remotely connect to your organization’s network or leverage to your organization’s network or leverage remote
connection technologies that remote connection technologies that support MFA. support MFA.
Research open source intelligence to develop a public footprint of your organization. a public footprint of your organization.
Train employees on social engineering and phishing email tactics and techniques. phishing email tactics and techniques.
Purchase a cyber insurance policy and familiarize yourself with the preferred vendors yourself with the preferred vendors within your policy. within your policy.
Build a close working relationship with a cyber advisory company.
Back to Blog Posts
Article
FortiBleed Campaign Linked to INC and Lynx Ransomware Operations
Researchers have linked the FortiBleed credential-harvesting campaign to the INC and Lynx ransomware-as-a-service (RaaS) operations, establishing a direct connection between large-scale FortiGate credential theft and subsequent ransomware deployment. The attribution is based on a variety of factors, including an operator observed managing negotiation panels for both ransomware groups, notable overlap between FortiBleed victim data and subsequent ransomware targets, and internal infrastructure exposing attack workflows. The campaign is estimated to have targeted more than 430,000 internet-facing FortiGate devices, resulting in administrative access to hundreds of organizations.
What’s Notable and Unique
Researchers identified a shared operator actively managing negotiation panels for both the INC and Lynx ransomware groups, providing rare operational evidence linking the two RaaS operations beyond infrastructure or malware similarities.
Analysis of the exposed infrastructure revealed a structured ransomware operation with dedicated roles for access acquisition, victim management, negotiations, and technical support, reflecting an organized ransomware-as-a-service (RaaS) model rather than an ad hoc criminal group.
The operation reportedly integrates artificial intelligence into multiple stages of the attack lifecycle, including vulnerability research, penetration testing, attack automation, and ransomware development, demonstrating the increasing adoption of AI to enhance offensive capabilities.
Mitigations
Organizations should assume that exposed or previously compromised FortiGate credentials may be leveraged for ransomware deployment and immediately reset administrative and VPN credentials while enforcing multi-factor authentication (MFA) for all privileged access. Security teams should ensure that FortiGate appliances are fully patched, restrict management interfaces to trusted networks, and audit administrative accounts and firewall configurations for unauthorized changes. Organizations should also monitor for anomalous authentication activity, hunt for published indicators of compromise (IOCs), and review VPN and firewall logs for signs of unauthorized access. Maintaining centralized logging and a well-practiced incident response process can help detect and contain attacks before they progress to lateral movement or ransomware deployment.
Analyst Comments
The attribution of FortiBleed to the INC and Lynx ransomware operations reinforces the growing convergence between credential-harvesting campaigns and ransomware deployment, highlighting the role of initial access operations in modern RaaS ecosystems. The relationship between INC and Lynx also aligns with Arete's previous research, which identified a shared malware lineage. INC Ransom, first observed in 2023, was later leaked or sold, enabling code reuse by other threat actors. Lynx, which emerged in 2024, is widely regarded as an evolution of the INC codebase. Sinobi ransomware, identified in 2025, shares near-identical binaries and infrastructure, and approximately 99% code similarity with Lynx. Further details on the code correlation between INC, Lynx, and Sinobi are available in Arete's 2025 Annual Report.
Sources
Is FortiBleed Linked to INC and Lynx Ransomware?
FortiBleed credential-theft campaign linked to Lynx ransomware
FortiBleed Unmasked: A Joint Operation by Lynx and INC Ransomware Groups
FortiBleed Credential Theft Campaign Attributed to INC and Lynx Ransomware Groups
Article
Ransomware Trends & Data Insights: June 2026
Although Akira was once again the most active ransomware threat in June, activity remained relatively distributed among multiple threat groups, with 17 unique threat groups observed throughout the month. Along with Akira, Qilin and INC Ransom remained active and were among the top five most active threat groups observed in June. Several new threat actors also emerged during the month, including KryBit, Settra, and Icarus.
Figure 1. Activity from the top 5 threat groups in June 2026
Throughout the month, analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:
In June, a threat actor calling themselves Icarus compromised and exfiltrated data from customers of the market intelligence platform Klue. Klue later confirmed the security incident, which involved attackers stealing OAuth tokens used to connect to customers' Salesforce environments, and reported that the threat actor was deleting the data stolen from affected Klue customers. In an odd twist, reports emerged of a second threat actor claiming to have compromised Icarus's infrastructure and attempting to re-extort Klue's customers. Regardless, the Klue breach highlights the growing threat of software-as-a-service (SaaS) supply chain compromises, particularly those exploiting OAuth tokens and trusted integrations to bypass traditional security controls.
In mid-June, security researchers identified a large-scale credential-harvesting and valid account abuse campaign dubbed “FortiBleed” that systematically targets internet-facing Fortinet FortiGate firewalls and SSL-VPN gateways, relying heavily on automated password spraying and configuration exfiltration rather than vulnerability exploitation. The scale of exposure and attack activity has been significant and globally distributed, with attackers collecting the login credentials of over 86,000 FortiGate devices across 194 countries. There is no singular ‘fix’ to mitigate the database exposure, and it is important that organizations work with their security teams, incident response providers, and other stakeholders to review environments holistically and monitor for signs of potentially unauthorized activity.
Multiple threat groups continue to leverage vulnerable drivers to bypass endpoint detection and response (EDR) solutions in a technique known as Bring Your Own Vulnerable Driver (BYOVD). Arete has observed Akira and DragonForce using the technique in multiple engagements, and The Gentlemen ransomware-as-a-service (RaaS) has also been observed using what researchers are calling "GentleKiller", a framework consisting of multiple variants that leverage vulnerable drivers and EDR-disabling utilities to target a wide range of endpoint security products.
Sources
Arete Internal
Article
Update on FortiBleed Credential Exposure
Last week, security researchers identified a large-scale credential-harvesting and valid account abuse campaign dubbed “FortiBleed” that systematically targets internet-facing Fortinet FortiGate firewalls and SSL-VPN gateways. The campaign relies heavily on automated password spraying and configuration exfiltration rather than vulnerability exploitation.
Attackers first scan for exposed FortiGate devices and rank targets based on revenue. SSH brute-force attacks are used against admin accounts to gain initial access.
Following initial access, operators deploy stealthy packet-sniffing capabilities and establish external listening posts to receive harvested credentials and session data in near real time.
Observed post-exploitation activity strongly indicates pre-positioning for broader enterprise compromise, including lateral movement and potential ransomware deployment.
The scale of exposure and attack activity has been significant and globally distributed. The campaign has been ongoing since at least February 2026, with attackers collecting the login credentials of over 86,000 FortiGate devices across 194 nations.
How Arete Can Help
Arete continues to monitor this campaign, utilizing our extensive experience in detection, threat hunting, and attack surface review to look for indications of unauthorized activity related to this database exposure. Additional information regarding important considerations, containment and credential compromise mitigation actions, and additional hardening recommendations can be found in Arete’s FortiBleed Advisory.
Sources
FortiBleed: SOCRadar’s Investigation into 86,644 Compromised Fortinet Firewalls
FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist
FortiBleed: The Most Detailed Breakdown Yet of an Active Russian Credential-Harvesting Operation
Hackers Using FortigateSniffer Tool That Turns Compromised Firewalls Into Password Collectors
Article
Europol Disrupts AudiA6 Crypto Laundering Service
European authorities have dismantled AudiA6, a major cryptocurrency laundering service linked to ransomware groups and broader cybercriminal networks. Between 2022 and 2025, the platform is believed to have processed over €336 million in illicit funds, enabling threat actors to obscure financial trails and monetize cybercrime proceeds. Its operators are also suspected of running Dark2Web, a dark web forum that facilitated collaboration, services, and connections among cybercriminals globally. This development underscores the expanding role of sophisticated, large-scale cryptocurrency laundering services in sustaining the cybercrime economy, enabling threat actors to obscure illicit funds and evade regulatory controls.
What’s Notable and Unique
Following law enforcement disruption of Cryptex and Garantex, AudiA6 emerged as another platform involved in financial activities linked to ransomware groups. Investigators believe that AudiA6 became a central hub for cybercriminals seeking to launder stolen digital assets while obscuring the transaction trail from authorities.
On June 10, 2026, a coordinated operation resulted in two arrests in Georgia, the dismantling of key infrastructure (30+ servers, 25 domains), the freezing or seizure of over €778,000 in crypto, and the takedown of the AudiA6 and Dark2Web platforms.
Analyst Comments
Ransomware groups and cybercriminal networks are increasingly leveraging sophisticated techniques, including chain-hopping, decentralized exchanges, and mixer-as-a-service platforms, to rapidly move illicit cryptocurrency across multiple blockchains, effectively obscuring transaction trails. Concurrently, the widespread use of fraudulent exchange accounts, mule wallets, and privacy-enhancing tools has elevated cryptocurrency laundering to a core enabler of the cybercrime ecosystem, allowing actors to bypass anti-money-laundering controls at scale. This investigation identified over 6,000 KYC records linked to money-mule accounts, many of which were tied to Russian-speaking intermediaries specifically recruited to facilitate the movement of illicit proceeds. These threat actors systematically used both commercial and domain-controlled email services to establish mule accounts across multiple cryptocurrency platforms. Collectively, these findings underscore the growing scale, coordination, and professionalization of cryptocurrency-enabled crime, highlighting the critical need for sustained, intelligence-led, and internationally coordinated efforts to disrupt these evolving financial ecosystems.
Sources
Ransomware gangs cut off from EUR 336 million ‘AudiA6’ crypto laundering pipeline