Krybit leaks ProHealth Singapore VPN creds
Ransomware group Krybit exposed FortiOS SSL-VPN credentials for Singapore's ProHealth, tied to the 2022 FortiBleed flaw (CVE-2022-40684).
Ransomware.live has indexed a leak entry attributed to the Krybit ransomware operation, listing prohealth.sg (ProHealth Singapore) as a victim. The listing states that the organization's FortiOS SSL-VPN credentials were exposed via the FortiBleed vulnerability, an authentication bypass in Fortinet's FortiOS/FortiProxy administrative interface that was disclosed in 2022 and has been widely abused by multiple threat actors to harvest VPN credentials and gain initial network access.
The entry appears to be a standard victim-shaming leak post rather than a detailed technical disclosure, providing DNS records and a screenshot as proof of compromise. No malware samples, additional infrastructure, or a full description of the intrusion chain following credential theft were provided in the source material. Given the healthcare sector nexus and use of a known, patchable Fortinet vulnerability for initial access, this represents a routine but concerning case of unpatched edge infrastructure being leveraged for ransomware operations.
Mentioned in this report
Detection guidance
FortiOS SSL-VPN Authentication Bypass Exploitation Attempts
Detects HTTP requests to FortiOS administrative interface paths known to be vulnerable to authentication bypass (FortiBleed CVE-2022-40684), typically targeting /api/v2/cmdb or /api/v2/monitor endpoints without proper authentication headers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS SSL-VPN Authentication Bypass Exploitation Attempts
description: Detects HTTP requests to FortiOS administrative API endpoints vulnerable
to FortiBleed authentication bypass. Targets /api/v2/cmdb and /api/v2/monitor paths
accessed without valid session tokens, consistent with exploitation attempts to
harvest credentials.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: proxy
product: fortinet
detection:
selection_vulnerable_paths:
http_request_line|contains:
- /api/v2/cmdb
- /api/v2/monitor
http_method:
- GET
- POST
filter_legitimate_admin:
source_ip|startswith:
- '10.'
- 172.16.
- 192.168.
condition: selection_vulnerable_paths and not filter_legitimate_admin
falsepositives:
- Legitimate FortiOS administrative access from internal networks
- Authorized vulnerability scanning of Fortinet appliances
level: high
id: 06815aea-e116-53e1-9229-7b58bf0bf6fb
status: experimental
author: Vorant
Suspicious VPN Credential Access from FortiOS Administrative Interface
Detects FortiOS administrative API queries targeting user credential endpoints (/api/v2/cmdb/user or /api/v2/cmdb/vpn) that typically precede credential harvest operations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious VPN Credential Access from FortiOS Administrative Interface
description: Detects HTTP requests to FortiOS API endpoints exposing VPN user credentials
and authentication objects. Targets /api/v2/cmdb/user and /api/v2/cmdb/vpn paths
accessed via unauthenticated or low-privilege sessions, consistent with credential
enumeration following FortiBleed exploitation.
tags:
- attack.credential-access
- attack.t1078
logsource:
category: proxy
product: fortinet
detection:
selection_credential_endpoints:
http_request_line|contains:
- /api/v2/cmdb/user
- /api/v2/cmdb/vpn
- /api/v2/cmdb/authentication
http_method:
- GET
- POST
selection_suspicious_access:
http_status_code: 200
source_ip|contains:
- ':'
filter_internal_admin:
source_ip|startswith:
- '10.'
- 172.16.
- 192.168.
condition: selection_credential_endpoints and selection_suspicious_access and not
filter_internal_admin
falsepositives:
- Legitimate FortiOS backup and configuration export operations by administrators
- Authorized API clients querying user objects for management purposes
level: medium
id: 4a3df361-36d7-5f09-9cba-65b6d052b9c6
status: experimental
author: Vorant
FortiOS Administrative Interface Accessed Without Valid Session
Detects HTTP requests to FortiOS administrative web interface (/admin or /dashboard paths) returning HTTP 200 without corresponding authenticated session tokens, indicating potential authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS Administrative Interface Accessed Without Valid Session
description: Detects successful HTTP requests to FortiOS administrative interface
paths without valid session authentication, typical of FortiBleed CVE-2022-40684
exploitation where attackers bypass authentication checks on the admin backend.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: proxy
product: fortinet
detection:
selection_admin_paths:
http_request_line|contains:
- /admin
- /dashboard
- /ng
destination_port: 443
selection_no_auth:
http_status_code: 200
http_request_headers|contains:
- Cookie
filter_valid_session:
http_request_headers|contains:
- PHPSESSID
- ccsrftoken
condition: selection_admin_paths and selection_no_auth and not filter_valid_session
falsepositives:
- Legitimate administrative access with session tokens in request body instead of
headers
- Network monitoring tools querying appliance status endpoints
level: high
id: b09a66aa-70a4-511c-8fd8-8d706eb7b5a3
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/d3d3LnByb2hlYWx0aC5zZ0BrcnliaXQ=
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free