Emerging group HYFLOCK claims India's IGPL breach
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
A new, unverified ransomware group named HYFLOCK claims to have attacked Indian petrochemical maker IGPL, which also had FortiOS VPN credentials exposed via FortiBleed.
Ransomware.live has logged a claim by an emerging, as-yet-unverified ransomware group referred to as HYFLOCK against India Glycols/IGPL, a Mumbai-headquartered, NSE/BSE-listed petrochemical manufacturer and India's largest single-site producer of Phthalic Anhydride. The claimed attack date is 2026-10-10 with discovery on 2026-10-13; as with all newly surfaced extortion group claims, this should be treated cautiously until independently verified, since no leak sample or technical details are provided beyond the listing.
Supporting exposure data compiled by third-party scanners (HudsonRock, ParanoidLab) shows the organization has a measurable external attack surface: infostealer logs tied to 2 compromised users and 7 third-party employee credential sets, and a password-exposure report flagging 118 exposed passwords (18 rated critical). Notably, the domain's FortiOS SSL-VPN credentials were found exposed via the historical FortiBleed vulnerability (CVE-2022-40684), an authentication-bypass flaw in FortiOS/FortiProxy SSL-VPN interfaces that has been actively exploited since 2022 to harvest credentials and gain unauthorized access. While the article does not confirm FortiBleed was the initial access vector for the ransomware claim, the co-occurrence of exposed VPN credentials and infostealer activity on employee accounts represents a plausible access path defenders should investigate and remediate regardless of the ransomware claim's veracity.
Defenders in the chemicals/petrochemical manufacturing space, or any organization using Fortinet SSL-VPN appliances, should confirm patching against CVE-2022-40684, rotate any credentials that may have been harvested via FortiBleed or infostealers, and monitor for anomalous VPN logins, credential reuse, and unauthorized access tied to exposed employee and third-party accounts.
Mentioned in this report
Detection guidance
FortiOS Admin API Access with Report Runner User-Agent (CVE-2022-40684)
Detects requests to the FortiOS /api/v2/cmdb/ management API using the 'Report Runner' User-Agent, a known marker of CVE-2022-40684 authentication-bypass exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS Admin API Access with Report Runner User-Agent (CVE-2022-40684)
description: Detects HTTP requests to the FortiOS/FortiProxy /api/v2/cmdb/ management
API carrying the 'Report Runner' User-Agent, a known marker of CVE-2022-40684 authentication-bypass
exploitation used to gain access to SSL-VPN/admin interfaces and harvest credentials.
Applies to web or reverse-proxy logs in front of the appliance management interface.
status: experimental
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-user-agent|contains: Report Runner
cs-uri-stem|contains: /api/v2/cmdb/
condition: selection
falsepositives:
- Authorised vulnerability scanners or red-team exercises testing for CVE-2022-40684
level: high
id: 472f5462-3b84-56cd-81fa-9e8a77ebcd41
author: Vorant
references:
- https://www.ransomware.live/id/SUdQTEBIWUZMT0NL
FortiOS Admin Account or SSH Key Modification via CMDB API
Detects successful PUT/POST requests to the FortiOS CMDB admin endpoint, consistent with CVE-2022-40684 exploitation adding SSH keys or admin users. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS Admin Account or SSH Key Modification via CMDB API
description: Detects successful PUT/POST requests to the FortiOS /api/v2/cmdb/system/admin
endpoint, consistent with CVE-2022-40684 exploitation to inject an SSH public key
or create an admin account for persistent access. Review the source IP against known
administrator addresses.
status: experimental
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1078
logsource:
category: webserver
detection:
selection:
cs-method:
- PUT
- POST
cs-uri-stem|contains: /api/v2/cmdb/system/admin
sc-status:
- 200
- 201
condition: selection
falsepositives:
- Legitimate administrators or configuration-management automation changing admin
accounts via the REST API from management hosts
level: medium
id: de9f81e6-a0d8-58cd-8ab5-b1c2e0626307
author: Vorant
references:
- https://www.ransomware.live/id/SUdQTEBIWUZMT0NL
2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/SUdQTEBIWUZMT0NL
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs