Nightspirit ransomware claims Brazilian pipe maker
Ransomware.live lists Tubos da Amazônia Ltda as a Nightspirit ransomware victim, with exposure tied to leaked FortiOS SSL-VPN credentials.
This is a victim-tracking entry from ransomware.live documenting a claimed breach of Tubos da Amazônia Ltda by a group tracked as Nightspirit. The listing provides minimal technical detail, noting a small number of compromised user and third-party employee credentials, one exposed external attack surface asset, and reference to the FortiOS SSL-VPN credential exposure linked to CVE-2022-40684 (the Fortinet authentication bypass vulnerability, colloquially referenced here alongside the 'FortiBleed' leak). No stolen data, IOCs, or technical intrusion details are disclosed by the platform, which only indexes publicly claimed leak-site postings.
For defenders, the key takeaway is that organizations running Fortinet FortiOS/FortiProxy SSL-VPN appliances that were vulnerable to CVE-2022-40684 and have not rotated credentials since patching remain at risk of credential-based follow-on compromise, including ransomware deployment. Organizations should verify patch status on internet-facing Fortinet devices, force credential rotation for VPN and administrative accounts exposed during the vulnerability's active-exploitation window, and monitor for anomalous VPN logins or third-party credential reuse.
Mentioned in this report
Detection guidance
Mass File Encryption Activity Post-VPN Compromise
Detects rapid, bulk file encryption operations on internal networks following anomalous VPN or third-party account access, consistent with ransomware deployment after credential-based lateral movement. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Mass File Encryption Activity Post-VPN Compromise
description: Detects processes performing high-volume file encryption operations across
network shares, executed from systems that recently accepted suspicious VPN sessions
or third-party credentials. Flags the distinctive patterns of encryption tools scanning
directories and modifying file extensions.
tags:
- attack.impact
- attack.t1486
logsource:
category: process_creation
product: windows
detection:
selection_encryption_process:
CommandLine|contains:
- .exe
- .bat
- .ps1
Image|endswith:
- \powershell.exe
- \cmd.exe
- \wmic.exe
selection_encryption_behavior:
CommandLine|contains:
- '*.ppt'
- '*.doc'
- '*.xls'
- '*.pdf'
- encrypt
- cipher
selection_network_path:
CommandLine|contains:
- \\\\
- net use
- mount
condition: selection_encryption_process and (selection_encryption_behavior or selection_network_path)
falsepositives:
- Legitimate backup or document processing tools scanning and accessing office files
- System maintenance utilities performing disk cleanup or archive operations
level: high
id: 68fee8a1-120d-51ae-b79f-192a39ad8a5f
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/VHVib2HDp29zIGRhIEFtYXrDtG5pYSBMdGRhLkBuaWdodHNwaXJl
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free