Fortinet Firewall Intrusions Linked to Ransomware Activity and Nextcloud Exploitation

Attackers associated with the so-called FortiBleed activity are reportedly turning unauthorized access to Fortinet firewalls into profit. According to the report, the operators are no longer just entering networks at scale; they are now attempting to monetize that access and appear to be working alongside ransomware crews.

The groups named in connection with this activity include INC and Lynx, two ransomware brands that have been active in recent campaigns. The shift suggests that firewall intrusions are being used as a starting point for broader extortion efforts, rather than as isolated compromises. Once inside perimeter devices, threat actors can potentially move deeper into targeted environments, collect credentials, and identify high-value systems.

Nextcloud Zero-Day Adds to the Threat Landscape

The same report also says attackers are taking advantage of a separate Nextcloud zero-day vulnerability. That development points to a wider pattern in which criminals quickly adopt newly disclosed or previously unknown flaws to expand their reach. By combining access through edge devices with exploitation of application-layer bugs, attackers can increase the chances of finding exposed organizations and bypassing traditional defenses.

Fortinet appliances and collaboration platforms such as Nextcloud are common targets because they often sit at the center of enterprise access. When either is compromised, the impact can be substantial, especially if administrators have not yet applied updates or reviewed logs for unusual activity.

What Organizations Should Watch

• Review Fortinet firewall logs for signs of unauthorized access or configuration changes.
• Patch Nextcloud systems as soon as fixes are available for any confirmed zero-day issue.
• Check for unusual authentication activity, new accounts, or unexpected remote connections.
• Segment critical systems to limit the blast radius if an edge device is compromised.

Security teams should treat edge-device intrusions as urgent, since they can provide attackers with a direct path into internal networks and, in some cases, a fast route to ransomware deployment.