TheGentlemen ransomware hits Ecuador police
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Ransomware group TheGentlemen claims Ecuador's National Police as a victim, with exposed FortiOS VPN credentials tied to the FortiBleed flaw.
Ransomware.live has listed Ecuador's National Police as a victim of the ransomware group known as "TheGentlemen." The posting indicates a large exposure footprint, including 399 compromised employees, over 11,000 compromised user accounts, 45 third-party employee credentials, and 124 external attack-surface findings tied to the victim's domain. Notably, the entry states that the domain's FortiOS SSL-VPN credentials were exposed via the "FortiBleed" leak, referencing CVE-2022-40684, a known FortiOS/FortiProxy authentication bypass vulnerability that has been widely exploited since 2022 to harvest credentials from exposed SSL-VPN appliances.
No specific technical details of the intrusion chain, exfiltrated data samples, or additional infrastructure were disclosed in this listing beyond the credential exposure and DNS enumeration. The entry functions primarily as a victim notification/tracking record on the Ransomware.live platform rather than a full incident writeup, though it signals that government infrastructure in Ecuador may have been compromised via previously known Fortinet vulnerabilities and associated credential leakage, consistent with ongoing exploitation campaigns against unpatched or legacy FortiOS SSL-VPN deployments.
Defenders, particularly in government and law-enforcement sectors, should verify FortiOS/FortiProxy patch levels against CVE-2022-40684, rotate SSL-VPN credentials if any device was ever exposed to this vulnerability, and review authentication logs for anomalous access from unfamiliar source IPs. Organizations using Fortinet SSL-VPN should treat any historical exposure to FortiBleed as a credential-compromise event requiring full credential rotation and MFA enforcement, even if the vulnerability itself has since been patched.
Mentioned in this report
Detection guidance
FortiOS CVE-2022-40684 Exploitation via Report Runner User-Agent on CMDB API
Detects requests to the FortiOS /api/v2/cmdb/ administrative API carrying the 'Report Runner' User-Agent, a known marker of CVE-2022-40684 authentication-bypass exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS CVE-2022-40684 Exploitation via Report Runner User-Agent on CMDB API
description: Detects HTTP requests to the FortiOS/FortiProxy /api/v2/cmdb/ administrative
API using the 'Report Runner' User-Agent, which is publicly documented as used in
CVE-2022-40684 authentication-bypass exploitation.
tags:
- attack.initial-access
- attack.t1190
- cve.2022-40684
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /api/v2/cmdb/
cs-user-agent|contains: Report Runner
condition: selection
falsepositives:
- Legitimate internal FortiManager or FortiOS report-runner components calling the
local API, if logged by an upstream reverse proxy
level: high
id: f90b32b7-a9e6-5224-b0f9-dc623ff1753d
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/RWN1YWRvcnMgTmF0aW9uYWwgUG9saWNlQHRoZWdlbnRsZW1lbg==
FortiOS Admin Account Modification via CMDB API PUT Request
Detects PUT/POST requests to the FortiOS CMDB admin endpoint, as used after CVE-2022-40684 bypass to add SSH keys or modify admin users. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS Admin Account Modification via CMDB API PUT Request
description: Detects PUT or POST requests to /api/v2/cmdb/system/admin/ on FortiOS/FortiProxy
web management interfaces. After exploiting CVE-2022-40684 attackers modify admin
users to add SSH public keys. Requests from unexpected source addresses should be
reviewed.
tags:
- attack.initial-access
- attack.t1190
- cve.2022-40684
logsource:
category: webserver
detection:
selection:
cs-method:
- PUT
- POST
cs-uri-stem|contains: /api/v2/cmdb/system/admin
condition: selection
falsepositives:
- Authorised administrators or automation (Ansible, FortiManager) changing admin accounts
via the REST API from known management hosts
level: medium
id: ef965a45-2ae7-51e6-b554-52f70960d6f3
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/RWN1YWRvcnMgTmF0aW9uYWwgUG9saWNlQHRoZWdlbnRsZW1lbg==
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/RWN1YWRvcnMgTmF0aW9uYWwgUG9saWNlQHRoZWdlbnRsZW1lbg==
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs