FortiBleed INC Ransom / Lynx Ransomware Deployment Detection

Ibrahim Saud@tektrix

•updated Jul 3, 2026•3•1•6

Detects PE binaries associated with INC Ransom or Lynx ransomware families identified during the FortiBleed campaign. The rule flags files containing both family-specific identification strings and commands intended to delete Volume Shadow Copies to prevent system recovery.