# TheGentlemen ransomware hits Ecuador police

Published: 2026-10-16 · Severity: severe · Sectors: government-national
Canonical: https://vorant.io/reports/0b340814-48ba-5c15-95b8-ac61c9e19cc2/thegentlemen-ransomware-hits-ecuador-police

> Ransomware group TheGentlemen claims Ecuador's National Police as a victim, with exposed FortiOS VPN credentials tied to the FortiBleed flaw.

Ransomware.live has listed Ecuador's National Police as a victim of the ransomware group known as "TheGentlemen." The posting indicates a large exposure footprint, including 399 compromised employees, over 11,000 compromised user accounts, 45 third-party employee credentials, and 124 external attack-surface findings tied to the victim's domain. Notably, the entry states that the domain's FortiOS SSL-VPN credentials were exposed via the "FortiBleed" leak, referencing CVE-2022-40684, a known FortiOS/FortiProxy authentication bypass vulnerability that has been widely exploited since 2022 to harvest credentials from exposed SSL-VPN appliances.

No specific technical details of the intrusion chain, exfiltrated data samples, or additional infrastructure were disclosed in this listing beyond the credential exposure and DNS enumeration. The entry functions primarily as a victim notification/tracking record on the Ransomware.live platform rather than a full incident writeup, though it signals that government infrastructure in Ecuador may have been compromised via previously known Fortinet vulnerabilities and associated credential leakage, consistent with ongoing exploitation campaigns against unpatched or legacy FortiOS SSL-VPN deployments.

Defenders, particularly in government and law-enforcement sectors, should verify FortiOS/FortiProxy patch levels against CVE-2022-40684, rotate SSL-VPN credentials if any device was ever exposed to this vulnerability, and review authentication logs for anomalous access from unfamiliar source IPs. Organizations using Fortinet SSL-VPN should treat any historical exposure to FortiBleed as a credential-compromise event requiring full credential rotation and MFA enforcement, even if the vulnerability itself has since been patched.

## Mentioned in this report

- Vulnerabilities: CVE-2022-40684 (KEV)
- Threat actors: The Gentlemen
- Malware: Gentlemen

## Detection guidance (public sample)

### FortiOS CVE-2022-40684 Exploitation via Report Runner User-Agent on CMDB API

ATT&CK: T1190

Detects requests to the FortiOS /api/v2/cmdb/ administrative API carrying the 'Report Runner' User-Agent, a known marker of CVE-2022-40684 authentication-bypass exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiOS CVE-2022-40684 Exploitation via Report Runner User-Agent on CMDB API
description: Detects HTTP requests to the FortiOS/FortiProxy /api/v2/cmdb/ administrative
  API using the 'Report Runner' User-Agent, which is publicly documented as used in
  CVE-2022-40684 authentication-bypass exploitation.
tags:
- attack.initial-access
- attack.t1190
- cve.2022-40684
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: /api/v2/cmdb/
    cs-user-agent|contains: Report Runner
  condition: selection
falsepositives:
- Legitimate internal FortiManager or FortiOS report-runner components calling the
  local API, if logged by an upstream reverse proxy
level: high
id: f90b32b7-a9e6-5224-b0f9-dc623ff1753d
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/RWN1YWRvcnMgTmF0aW9uYWwgUG9saWNlQHRoZWdlbnRsZW1lbg==
```

### FortiOS Admin Account Modification via CMDB API PUT Request

ATT&CK: T1190

Detects PUT/POST requests to the FortiOS CMDB admin endpoint, as used after CVE-2022-40684 bypass to add SSH keys or modify admin users. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiOS Admin Account Modification via CMDB API PUT Request
description: Detects PUT or POST requests to /api/v2/cmdb/system/admin/ on FortiOS/FortiProxy
  web management interfaces. After exploiting CVE-2022-40684 attackers modify admin
  users to add SSH public keys. Requests from unexpected source addresses should be
  reviewed.
tags:
- attack.initial-access
- attack.t1190
- cve.2022-40684
logsource:
  category: webserver
detection:
  selection:
    cs-method:
    - PUT
    - POST
    cs-uri-stem|contains: /api/v2/cmdb/system/admin
  condition: selection
falsepositives:
- Authorised administrators or automation (Ansible, FortiManager) changing admin accounts
  via the REST API from known management hosts
level: medium
id: ef965a45-2ae7-51e6-b554-52f70960d6f3
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/RWN1YWRvcnMgTmF0aW9uYWwgUG9saWNlQHRoZWdlbnRsZW1lbg==
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/RWN1YWRvcnMgTmF0aW9uYWwgUG9saWNlQHRoZWdlbnRsZW1lbg==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0b340814-48ba-5c15-95b8-ac61c9e19cc2/thegentlemen-ransomware-hits-ecuador-police.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup