# Nightspirit ransomware claims Brazilian pipe maker

Published: 2026-09-11 · Severity: elevated · Sectors: manufacturing
Canonical: https://vorant.io/reports/0151be4c-9372-5961-9c12-7ee0f7fdc008/nightspirit-ransomware-claims-brazilian-pipe-maker

> Ransomware.live lists Tubos da Amazônia Ltda as a Nightspirit ransomware victim, with exposure tied to leaked FortiOS SSL-VPN credentials.

This is a victim-tracking entry from ransomware.live documenting a claimed breach of Tubos da Amazônia Ltda by a group tracked as Nightspirit. The listing provides minimal technical detail, noting a small number of compromised user and third-party employee credentials, one exposed external attack surface asset, and reference to the FortiOS SSL-VPN credential exposure linked to CVE-2022-40684 (the Fortinet authentication bypass vulnerability, colloquially referenced here alongside the 'FortiBleed' leak). No stolen data, IOCs, or technical intrusion details are disclosed by the platform, which only indexes publicly claimed leak-site postings.

For defenders, the key takeaway is that organizations running Fortinet FortiOS/FortiProxy SSL-VPN appliances that were vulnerable to CVE-2022-40684 and have not rotated credentials since patching remain at risk of credential-based follow-on compromise, including ransomware deployment. Organizations should verify patch status on internet-facing Fortinet devices, force credential rotation for VPN and administrative accounts exposed during the vulnerability's active-exploitation window, and monitor for anomalous VPN logins or third-party credential reuse.

## Mentioned in this report

- Vulnerabilities: CVE-2022-40684 (KEV)
- Threat actors: Nightspirit
- Malware: Nightspirit

## Detection guidance (public sample)

### Mass File Encryption Activity Post-VPN Compromise

ATT&CK: T1486

Detects rapid, bulk file encryption operations on internal networks following anomalous VPN or third-party account access, consistent with ransomware deployment after credential-based lateral movement. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Mass File Encryption Activity Post-VPN Compromise
description: Detects processes performing high-volume file encryption operations across
  network shares, executed from systems that recently accepted suspicious VPN sessions
  or third-party credentials. Flags the distinctive patterns of encryption tools scanning
  directories and modifying file extensions.
tags:
- attack.impact
- attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection_encryption_process:
    CommandLine|contains:
    - .exe
    - .bat
    - .ps1
    Image|endswith:
    - \powershell.exe
    - \cmd.exe
    - \wmic.exe
  selection_encryption_behavior:
    CommandLine|contains:
    - '*.ppt'
    - '*.doc'
    - '*.xls'
    - '*.pdf'
    - encrypt
    - cipher
  selection_network_path:
    CommandLine|contains:
    - \\\\
    - net use
    - mount
  condition: selection_encryption_process and (selection_encryption_behavior or selection_network_path)
falsepositives:
- Legitimate backup or document processing tools scanning and accessing office files
- System maintenance utilities performing disk cleanup or archive operations
level: high
id: 68fee8a1-120d-51ae-b79f-192a39ad8a5f
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/VHVib2HDp29zIGRhIEFtYXrDtG5pYSBMdGRhLkBuaWdodHNwaXJl

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0151be4c-9372-5961-9c12-7ee0f7fdc008/nightspirit-ransomware-claims-brazilian-pipe-maker.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup