Article
Top Tips to Improve Cybersecurity Today
Arete Analysis
By Kevin Baker
When I work with clients, I mention a good many things they can do to improve their security. Sometimes I’ll advise on an area I think they need to understand about their company. Sometimes I’ll suggest implementing specific security controls. Some things I propose are very important; others are “nice to haves.” And while my recommendations may change based on the attributes of the client company and the skill level of those involved in fighting the good fight, there are always six things I tell every client.
1: Clean up accounts
Clean up the accounts in your Windows domain by eliminating every account that doesn’t have a valid business purpose — and that includes both human identity and service (aka machine identity) accounts. Software on your servers uses service accounts to perform a specific function, often with a high level of privilege.
“Stale” accounts create unneeded risk and only up the chances of attackers succeeding in their mission. If you don’t understand why an account exists, either justify its existence or carefully remove it.
2: Ditch unnecessary data
Understand what sensitive data is for your company and locate every instance of what you deem sensitive across both your corporate and cloud environments. Most companies think they know where sensitive data is because they’ve asked the subject matter experts (SMEs). Nothing against SMEs, but the best practice is to examine and verify the file stores and network.
Rarely have I seen assumed inventory be accurate. What we think we have is usually orders of magnitude less than what is ultimately discovered.
As with stale accounts, stale data and unneeded or unknown copies of data create big risk. When a breach happens, the accumulation of stale data across file servers, public drives, and email clients will only make a bad day that much worse. So, if you don’t need it, get rid of it.
3: Use multifactor authentication
Passwords are no longer enough to guarantee protection and should be considered table stakes. Why? Because billions of passwords have been lost in breaches of high-profile companies, and people are prone to re-using passwords. A lost password in one place usually exposes multiple accounts and locations.
What’s more, supercomputing and artificial intelligence (AI) can eventually crack nearly every password. For this reason, multifactor authentication (MFA) is one of the best ways to protect your identity, your data, and your reputation. It’s well worth the time, effort, and expense to use MFA.
4. Make cybersecurity everyone’s responsibility
Step one in building an information security training program: Set expectations. Companies need to be clear with regards to employee responsibility around use of company systems and data. Though words cannot protect us directly, policies, standards, and guidelines are useful in setting a standard of due care that employees can clearly understand.
While there are many good security-awareness programs and resources available that teach social-engineering resistance and good security practices, they may not be worth the time or investment without a clear mandate from the company stating expectations of behavior and technical conditions.
Set a simple, but powerful policy: “Every employee is responsible for protecting the data entrusted to our company.”
5. Write an incident response plan
It’s an oft repeated phrase because it’s true: Breaches are not a matter of if, but when. So, don’t wait until it’s too late. Write an incident response plan now and don’t be caught flat-footed at a most critical moment.
And remember, security is not solely a technology problem, it’s also a business problem. IT plays a big role and may drive most of the actions during a breach, but they cannot effectively handle response alone. Everyone in the company is a stakeholder and every department should have a representative on the incident response (IR) team. Thus, make sure your plan assigns specific people to respond, including IT, management, and business representatives.
Inter-departmental communication is key to a swift response and should be part of what you practice. For example, who will talk to the news crews out front? Be sure to media-train personnel or have a crisis communication firm on speed dial. In fact, be sure to have all key contacts listed in your IR plan, including those for all related services or vendors. And regardless of how many venders you use, be sure to have clarity on the internal team as to who will coordinate the response and look after your company’s best interests.
Once you write your plan, practice it — again and again. You’ll improve every time, building muscle memory for fast detection and fast reaction to events that help ensure your success, not the bad guy’s. At a minimum, a good response will greatly minimize an event’s impact and, even if not wholly prevented, still add up to thousands of dollars saved.
6. Have a solid backup plan
Make sure you have a solid back up plan that includes offline copies.
Ransomware is a modern plague that’s costing the United States trillions of dollars per year. That money is going to fund organized crime, human trafficking, and terrorism. The bad actors will not stop what they are doing, and they will get around to you eventually.
As technology advanced, the use of backup tapes fell off, replaced by backups made to storage systems, the cloud, or both. If those online copies are protected by a Windows domain password, you will probably lose them. The first thing the threat actors will do is crack all the admin passwords and log into wherever you store those backups and encrypt them. Next, they’ll encrypt your endpoints, laptops and servers, and send a ransom note.
Expect to be attacked and prepare for it, not only by backing up your data, but also by having at least one offline copy of every critical system. An offline copy that cannot be accessed from any network will ensure that even if you are faced with a massive cleanup of encrypted systems, you’ll avoid having to pay a ransom.
Ransoms often cost hundreds of thousands of dollars, and may even run into the millions, so the cost of a solid disaster recovery plan, including offline copies, is peanuts by comparison.
Don’t make it easy on the bad guy
Like water, cybercriminals often take the path of least resistance. So, move, morph, and make your company a harder target to hit.
Want to see an immediate impact? Implement MFA. Want to harden your security over time? Find out and continue to track where your crown jewels reside.
These six steps are all within reach of every company. Start today, and get it done.
Back to Blog Posts
Article
FortiBleed Campaign Linked to INC and Lynx Ransomware Operations
Researchers have linked the FortiBleed credential-harvesting campaign to the INC and Lynx ransomware-as-a-service (RaaS) operations, establishing a direct connection between large-scale FortiGate credential theft and subsequent ransomware deployment. The attribution is based on a variety of factors, including an operator observed managing negotiation panels for both ransomware groups, notable overlap between FortiBleed victim data and subsequent ransomware targets, and internal infrastructure exposing attack workflows. The campaign is estimated to have targeted more than 430,000 internet-facing FortiGate devices, resulting in administrative access to hundreds of organizations.
What’s Notable and Unique
Researchers identified a shared operator actively managing negotiation panels for both the INC and Lynx ransomware groups, providing rare operational evidence linking the two RaaS operations beyond infrastructure or malware similarities.
Analysis of the exposed infrastructure revealed a structured ransomware operation with dedicated roles for access acquisition, victim management, negotiations, and technical support, reflecting an organized ransomware-as-a-service (RaaS) model rather than an ad hoc criminal group.
The operation reportedly integrates artificial intelligence into multiple stages of the attack lifecycle, including vulnerability research, penetration testing, attack automation, and ransomware development, demonstrating the increasing adoption of AI to enhance offensive capabilities.
Mitigations
Organizations should assume that exposed or previously compromised FortiGate credentials may be leveraged for ransomware deployment and immediately reset administrative and VPN credentials while enforcing multi-factor authentication (MFA) for all privileged access. Security teams should ensure that FortiGate appliances are fully patched, restrict management interfaces to trusted networks, and audit administrative accounts and firewall configurations for unauthorized changes. Organizations should also monitor for anomalous authentication activity, hunt for published indicators of compromise (IOCs), and review VPN and firewall logs for signs of unauthorized access. Maintaining centralized logging and a well-practiced incident response process can help detect and contain attacks before they progress to lateral movement or ransomware deployment.
Analyst Comments
The attribution of FortiBleed to the INC and Lynx ransomware operations reinforces the growing convergence between credential-harvesting campaigns and ransomware deployment, highlighting the role of initial access operations in modern RaaS ecosystems. The relationship between INC and Lynx also aligns with Arete's previous research, which identified a shared malware lineage. INC Ransom, first observed in 2023, was later leaked or sold, enabling code reuse by other threat actors. Lynx, which emerged in 2024, is widely regarded as an evolution of the INC codebase. Sinobi ransomware, identified in 2025, shares near-identical binaries and infrastructure, and approximately 99% code similarity with Lynx. Further details on the code correlation between INC, Lynx, and Sinobi are available in Arete's 2025 Annual Report.
Sources
Is FortiBleed Linked to INC and Lynx Ransomware?
FortiBleed credential-theft campaign linked to Lynx ransomware
FortiBleed Unmasked: A Joint Operation by Lynx and INC Ransomware Groups
FortiBleed Credential Theft Campaign Attributed to INC and Lynx Ransomware Groups
Article
Ransomware Trends & Data Insights: June 2026
Although Akira was once again the most active ransomware threat in June, activity remained relatively distributed among multiple threat groups, with 17 unique threat groups observed throughout the month. Along with Akira, Qilin and INC Ransom remained active and were among the top five most active threat groups observed in June. Several new threat actors also emerged during the month, including KryBit, Settra, and Icarus.
Figure 1. Activity from the top 5 threat groups in June 2026
Throughout the month, analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:
In June, a threat actor calling themselves Icarus compromised and exfiltrated data from customers of the market intelligence platform Klue. Klue later confirmed the security incident, which involved attackers stealing OAuth tokens used to connect to customers' Salesforce environments, and reported that the threat actor was deleting the data stolen from affected Klue customers. In an odd twist, reports emerged of a second threat actor claiming to have compromised Icarus's infrastructure and attempting to re-extort Klue's customers. Regardless, the Klue breach highlights the growing threat of software-as-a-service (SaaS) supply chain compromises, particularly those exploiting OAuth tokens and trusted integrations to bypass traditional security controls.
In mid-June, security researchers identified a large-scale credential-harvesting and valid account abuse campaign dubbed “FortiBleed” that systematically targets internet-facing Fortinet FortiGate firewalls and SSL-VPN gateways, relying heavily on automated password spraying and configuration exfiltration rather than vulnerability exploitation. The scale of exposure and attack activity has been significant and globally distributed, with attackers collecting the login credentials of over 86,000 FortiGate devices across 194 countries. There is no singular ‘fix’ to mitigate the database exposure, and it is important that organizations work with their security teams, incident response providers, and other stakeholders to review environments holistically and monitor for signs of potentially unauthorized activity.
Multiple threat groups continue to leverage vulnerable drivers to bypass endpoint detection and response (EDR) solutions in a technique known as Bring Your Own Vulnerable Driver (BYOVD). Arete has observed Akira and DragonForce using the technique in multiple engagements, and The Gentlemen ransomware-as-a-service (RaaS) has also been observed using what researchers are calling "GentleKiller", a framework consisting of multiple variants that leverage vulnerable drivers and EDR-disabling utilities to target a wide range of endpoint security products.
Sources
Arete Internal
Article
Update on FortiBleed Credential Exposure
Last week, security researchers identified a large-scale credential-harvesting and valid account abuse campaign dubbed “FortiBleed” that systematically targets internet-facing Fortinet FortiGate firewalls and SSL-VPN gateways. The campaign relies heavily on automated password spraying and configuration exfiltration rather than vulnerability exploitation.
Attackers first scan for exposed FortiGate devices and rank targets based on revenue. SSH brute-force attacks are used against admin accounts to gain initial access.
Following initial access, operators deploy stealthy packet-sniffing capabilities and establish external listening posts to receive harvested credentials and session data in near real time.
Observed post-exploitation activity strongly indicates pre-positioning for broader enterprise compromise, including lateral movement and potential ransomware deployment.
The scale of exposure and attack activity has been significant and globally distributed. The campaign has been ongoing since at least February 2026, with attackers collecting the login credentials of over 86,000 FortiGate devices across 194 nations.
How Arete Can Help
Arete continues to monitor this campaign, utilizing our extensive experience in detection, threat hunting, and attack surface review to look for indications of unauthorized activity related to this database exposure. Additional information regarding important considerations, containment and credential compromise mitigation actions, and additional hardening recommendations can be found in Arete’s FortiBleed Advisory.
Sources
FortiBleed: SOCRadar’s Investigation into 86,644 Compromised Fortinet Firewalls
FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist
FortiBleed: The Most Detailed Breakdown Yet of an Active Russian Credential-Harvesting Operation
Hackers Using FortigateSniffer Tool That Turns Compromised Firewalls Into Password Collectors
Article
Europol Disrupts AudiA6 Crypto Laundering Service
European authorities have dismantled AudiA6, a major cryptocurrency laundering service linked to ransomware groups and broader cybercriminal networks. Between 2022 and 2025, the platform is believed to have processed over €336 million in illicit funds, enabling threat actors to obscure financial trails and monetize cybercrime proceeds. Its operators are also suspected of running Dark2Web, a dark web forum that facilitated collaboration, services, and connections among cybercriminals globally. This development underscores the expanding role of sophisticated, large-scale cryptocurrency laundering services in sustaining the cybercrime economy, enabling threat actors to obscure illicit funds and evade regulatory controls.
What’s Notable and Unique
Following law enforcement disruption of Cryptex and Garantex, AudiA6 emerged as another platform involved in financial activities linked to ransomware groups. Investigators believe that AudiA6 became a central hub for cybercriminals seeking to launder stolen digital assets while obscuring the transaction trail from authorities.
On June 10, 2026, a coordinated operation resulted in two arrests in Georgia, the dismantling of key infrastructure (30+ servers, 25 domains), the freezing or seizure of over €778,000 in crypto, and the takedown of the AudiA6 and Dark2Web platforms.
Analyst Comments
Ransomware groups and cybercriminal networks are increasingly leveraging sophisticated techniques, including chain-hopping, decentralized exchanges, and mixer-as-a-service platforms, to rapidly move illicit cryptocurrency across multiple blockchains, effectively obscuring transaction trails. Concurrently, the widespread use of fraudulent exchange accounts, mule wallets, and privacy-enhancing tools has elevated cryptocurrency laundering to a core enabler of the cybercrime ecosystem, allowing actors to bypass anti-money-laundering controls at scale. This investigation identified over 6,000 KYC records linked to money-mule accounts, many of which were tied to Russian-speaking intermediaries specifically recruited to facilitate the movement of illicit proceeds. These threat actors systematically used both commercial and domain-controlled email services to establish mule accounts across multiple cryptocurrency platforms. Collectively, these findings underscore the growing scale, coordination, and professionalization of cryptocurrency-enabled crime, highlighting the critical need for sustained, intelligence-led, and internationally coordinated efforts to disrupt these evolving financial ecosystems.
Sources
Ransomware gangs cut off from EUR 336 million ‘AudiA6’ crypto laundering pipeline