42:I[185,["/_next/static/chunks/3xnt26d00_zk-.js","/_next/static/chunks/2aeejfufo02km.js","/_next/static/chunks/42spz6paskvb6.js","/_next/static/chunks/06x30xgfe6iur.js","/_next/static/chunks/2qm8z4gyuajgj.js","/_next/static/chunks/3jnlvw-emqotx.js"],"SendEmailButton"] 44:I[63625,["/_next/static/chunks/3xnt26d00_zk-.js","/_next/static/chunks/2aeejfufo02km.js","/_next/static/chunks/42spz6paskvb6.js","/_next/static/chunks/06x30xgfe6iur.js","/_next/static/chunks/2qm8z4gyuajgj.js","/_next/static/chunks/3jnlvw-emqotx.js"],"AddToLibraryButton"] 45:I[29721,["/_next/static/chunks/3xnt26d00_zk-.js","/_next/static/chunks/2aeejfufo02km.js","/_next/static/chunks/42spz6paskvb6.js","/_next/static/chunks/06x30xgfe6iur.js","/_next/static/chunks/2qm8z4gyuajgj.js","/_next/static/chunks/3jnlvw-emqotx.js"],"ShareButton"] 46:I[58016,["/_next/static/chunks/3xnt26d00_zk-.js","/_next/static/chunks/2aeejfufo02km.js","/_next/static/chunks/42spz6paskvb6.js","/_next/static/chunks/06x30xgfe6iur.js","/_next/static/chunks/2qm8z4gyuajgj.js","/_next/static/chunks/3jnlvw-emqotx.js"],"ProcessEpisodeButton"] 47:I[45269,["/_next/static/chunks/3xnt26d00_zk-.js","/_next/static/chunks/2aeejfufo02km.js","/_next/static/chunks/42spz6paskvb6.js","/_next/static/chunks/06x30xgfe6iur.js","/_next/static/chunks/2qm8z4gyuajgj.js","/_next/static/chunks/3jnlvw-emqotx.js"],"SignupCTA"] 3a:["$","time",null,{"dateTime":"2026-07-16T07:10:56.000Z","children":"July 16, 2026"}] 3b:["$","span",null,{"aria-hidden":true,"children":"·"}] 3c:["$","span",null,{"children":"00:48:03"}] 43:T4e9,

In this podcast episode SOCRadar CISO Ensar Seker and James Wilson chat about the company’s deep dive into the Fortibleed campaign. A small investigation into a curiously open directory on an unknown server expanded into the discovery of an attack that targeted 400,000 Fortinet devices.

As Ensar says, each time the SOCRadar team pulled a single thread, it led to a tapestry of AI-enabled cybercrime. They uncovered custom initial access, persistence and packet sniffing tools, as well as direct links to the INC and Lynx ransomware operations. Most interesting though is the use of AI to design, implement and operate all aspects of the campaign across a team of 20 individual actors. Operating more like a modern software company than a traditional cybercrime gang, Fortibleed serves as our first in-depth look at the future of cybercrime.

Show notes

SOCRadar Links FortiBleed Campaign to INC and Lynx Ransomware Operations