Pertamina targeted by ransomware via FortiOS SSL-VPN breach

17 September 2026 elevated threat energy

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Indonesian energy giant Pertamina compromised through exposed FortiOS SSL-VPN credentials from CVE-2022-40684 vulnerability.

Pertamina, Indonesia's state-owned oil and gas company, has been targeted by the Ransomehouse ransomware operation following exposure of FortiOS SSL-VPN credentials through the "FortiBleed" vulnerability (CVE-2022-40684). The breach exposed credentials for approximately 1,495 compromised employees and 26,510 compromised users, along with 613 third-party employee credentials. The attacker gained access to at least 200 external attack surface points within the victim's infrastructure. The vulnerability in Fortinet FortiOS allowed attackers to extract administrative credentials without authentication, which were then leveraged to access the victim's VPN infrastructure and facilitate the ransomware deployment. This incident demonstrates the continued risk from unpatched critical vulnerabilities in remote access infrastructure serving large organizations.

Mentioned in this report

Vulnerabilities CVE-2022-40684KEV

Threat actors Ransomehouse

Malware Ransomehouse

Detection guidance

Process Spawned by WinRM Host Process wsmprovhost

ATT&CK T1021.006

Shell or scripting interpreters spawned by wsmprovhost.exe, indicating commands run remotely over WinRM/PowerShell remoting, e.g. after VPN access with stolen credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Process Spawned by WinRM Host Process wsmprovhost
description: Detects command interpreters and common LOLBins spawned by wsmprovhost.exe,
  the host process for inbound WinRM / PowerShell remoting sessions. Useful for spotting
  lateral movement by an actor who entered through a compromised VPN account.
tags:
- attack.lateral-movement
- attack.t1021.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \wsmprovhost.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \net.exe
    - \net1.exe
    - \wmic.exe
  condition: selection
falsepositives:
- Administrators or configuration management tools (Ansible, SCCM scripts) running
  remote PowerShell sessions
- Monitoring agents that use WinRM to run health-check commands
level: medium
id: a7e65244-3f2d-522c-b0c3-b9d1f438e2e1
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/UGVydGFtaW5hQHJhbnNvbWhvdXNl

Remote Command Execution via winrs.exe

ATT&CK T1021.006

winrs.exe invoked with a remote target switch to run commands on another host over WinRM, a lateral movement method. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Remote Command Execution via winrs.exe
description: Detects Windows Remote Shell (winrs.exe) executed with a remote host
  argument, which runs commands on another system over WinRM. Generalises on the remote
  switch rather than any specific host or command.
tags:
- attack.lateral-movement
- attack.t1021.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith: \winrs.exe
  - OriginalFileName: winrs.exe
  selection_remote:
    CommandLine|contains:
    - ' -r:'
    - ' /r:'
    - ' -remote:'
    - ' /remote:'
  condition: selection_img and selection_remote
falsepositives:
- Administrators using winrs for remote management of servers
- Legacy automation scripts that rely on winrs
level: medium
id: 25e4f38c-6e20-5b02-a977-4bae13804f96
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/UGVydGFtaW5hQHJhbnNvbWhvdXNl

FortiOS Admin API Auth Bypass Exploitation Pattern (CVE-2022-40684)

ATT&CK T1078.001

HTTP PUT requests to the FortiOS cmdb admin API or the Report Runner user agent, matching CVE-2022-40684 authentication bypass used to take over admin accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: FortiOS Admin API Auth Bypass Exploitation Pattern (CVE-2022-40684)
description: Detects HTTP requests against the FortiOS management API that match the
  CVE-2022-40684 authentication bypass, namely PUT modifications of system admin objects
  or the Report Runner user agent against /api/v2/. Exploitation lets an attacker
  add SSH keys to or alter the admin account and then access the SSL-VPN infrastructure.
tags:
- attack.initial-access
- attack.persistence
- attack.t1078.001
- attack.t1190
logsource:
  category: webserver
detection:
  selection_put_admin:
    cs-method: PUT
    cs-uri-stem|contains: /api/v2/cmdb/system/admin
  selection_ua:
    cs-user-agent: Report Runner
    cs-uri-stem|contains: /api/v2/
  condition: 1 of selection_*
falsepositives:
- Legitimate administrators or FortiManager changing admin settings via the REST API
  from trusted management hosts
level: high
id: ed41d762-5d7b-56ce-b7d0-6e25474807ba
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/UGVydGFtaW5hQHJhbnNvbWhvdXNl

1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/UGVydGFtaW5hQHJhbnNvbWhvdXNl

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account What it costs