# Pertamina targeted by ransomware via FortiOS SSL-VPN breach

Published: 2026-09-17 · Severity: elevated · Sectors: energy
Canonical: https://vorant.io/reports/0382eb29-2854-5f25-b09b-e9f5cd04bc6c/pertamina-targeted-by-ransomware-via-fortios-ssl-vpn-breach

> Indonesian energy giant Pertamina compromised through exposed FortiOS SSL-VPN credentials from CVE-2022-40684 vulnerability.

Pertamina, Indonesia's state-owned oil and gas company, has been targeted by the Ransomehouse ransomware operation following exposure of FortiOS SSL-VPN credentials through the "FortiBleed" vulnerability (CVE-2022-40684). The breach exposed credentials for approximately 1,495 compromised employees and 26,510 compromised users, along with 613 third-party employee credentials. The attacker gained access to at least 200 external attack surface points within the victim's infrastructure. The vulnerability in Fortinet FortiOS allowed attackers to extract administrative credentials without authentication, which were then leveraged to access the victim's VPN infrastructure and facilitate the ransomware deployment. This incident demonstrates the continued risk from unpatched critical vulnerabilities in remote access infrastructure serving large organizations.

## Mentioned in this report

- Vulnerabilities: CVE-2022-40684 (KEV)
- Threat actors: Ransomehouse
- Malware: Ransomehouse

## Detection guidance (public sample)

### Process Spawned by WinRM Host Process wsmprovhost

ATT&CK: T1021.006

Shell or scripting interpreters spawned by wsmprovhost.exe, indicating commands run remotely over WinRM/PowerShell remoting, e.g. after VPN access with stolen credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Process Spawned by WinRM Host Process wsmprovhost
description: Detects command interpreters and common LOLBins spawned by wsmprovhost.exe,
  the host process for inbound WinRM / PowerShell remoting sessions. Useful for spotting
  lateral movement by an actor who entered through a compromised VPN account.
tags:
- attack.lateral-movement
- attack.t1021.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \wsmprovhost.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \net.exe
    - \net1.exe
    - \wmic.exe
  condition: selection
falsepositives:
- Administrators or configuration management tools (Ansible, SCCM scripts) running
  remote PowerShell sessions
- Monitoring agents that use WinRM to run health-check commands
level: medium
id: a7e65244-3f2d-522c-b0c3-b9d1f438e2e1
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/UGVydGFtaW5hQHJhbnNvbWhvdXNl
```

### Remote Command Execution via winrs.exe

ATT&CK: T1021.006

winrs.exe invoked with a remote target switch to run commands on another host over WinRM, a lateral movement method. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Remote Command Execution via winrs.exe
description: Detects Windows Remote Shell (winrs.exe) executed with a remote host
  argument, which runs commands on another system over WinRM. Generalises on the remote
  switch rather than any specific host or command.
tags:
- attack.lateral-movement
- attack.t1021.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith: \winrs.exe
  - OriginalFileName: winrs.exe
  selection_remote:
    CommandLine|contains:
    - ' -r:'
    - ' /r:'
    - ' -remote:'
    - ' /remote:'
  condition: selection_img and selection_remote
falsepositives:
- Administrators using winrs for remote management of servers
- Legacy automation scripts that rely on winrs
level: medium
id: 25e4f38c-6e20-5b02-a977-4bae13804f96
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/UGVydGFtaW5hQHJhbnNvbWhvdXNl
```

### FortiOS Admin API Auth Bypass Exploitation Pattern (CVE-2022-40684)

ATT&CK: T1078.001

HTTP PUT requests to the FortiOS cmdb admin API or the Report Runner user agent, matching CVE-2022-40684 authentication bypass used to take over admin accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiOS Admin API Auth Bypass Exploitation Pattern (CVE-2022-40684)
description: Detects HTTP requests against the FortiOS management API that match the
  CVE-2022-40684 authentication bypass, namely PUT modifications of system admin objects
  or the Report Runner user agent against /api/v2/. Exploitation lets an attacker
  add SSH keys to or alter the admin account and then access the SSL-VPN infrastructure.
tags:
- attack.initial-access
- attack.persistence
- attack.t1078.001
- attack.t1190
logsource:
  category: webserver
detection:
  selection_put_admin:
    cs-method: PUT
    cs-uri-stem|contains: /api/v2/cmdb/system/admin
  selection_ua:
    cs-user-agent: Report Runner
    cs-uri-stem|contains: /api/v2/
  condition: 1 of selection_*
falsepositives:
- Legitimate administrators or FortiManager changing admin settings via the REST API
  from trusted management hosts
level: high
id: ed41d762-5d7b-56ce-b7d0-6e25474807ba
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/UGVydGFtaW5hQHJhbnNvbWhvdXNl
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/UGVydGFtaW5hQHJhbnNvbWhvdXNl

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0382eb29-2854-5f25-b09b-e9f5cd04bc6c/pertamina-targeted-by-ransomware-via-fortios-ssl-vpn-breach.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup