# Fortinet flaw exposes hotel chain to Krybit ransomware

Published: 2026-09-12 · Severity: high
Canonical: https://vorant.io/reports/37e9ffe3-d7e5-5135-9a03-fad040a8b01c/fortinet-flaw-exposes-hotel-chain-to-krybit-ransomware

> A Turkish hotel group's FortiOS SSL-VPN credentials, leaked via the 2022 FortiBleed flaw, were listed by a ransomware crew tracked as Krybit.

Ransomware.live has indexed a victim listing tied to the ransomware group tracked as "Krybit," naming lasultanahotels.com as a target. According to the listing, the victim's FortiOS SSL-VPN credentials were exposed through the previously disclosed FortiBleed vulnerability (CVE-2022-40684), an authentication bypass in FortiOS/FortiProxy that allows unauthenticated attackers to read arbitrary files, including admin credential stores, on exposed management interfaces. This vulnerability was publicly disclosed and patched in 2022, but organizations that failed to patch or rotate credentials afterward remain susceptible to credential reuse by threat actors who harvested data during the original exploitation wave.

The entry provides no further technical detail beyond the leak notice itself — no ransom note content, encryption details, or confirmed data exfiltration volume are described in the source. For defenders, the key takeaway is that FortiBleed-derived credential leaks continue to surface in ransomware victim postings years after the original disclosure, underscoring the importance of not just patching FortiOS but also rotating all credentials and VPN certificates that may have been exposed prior to patching. Organizations still running unpatched FortiOS/FortiProxy SSL-VPN appliances, or those that patched without a full credential rotation, should treat any historical FortiBleed exposure as a standing risk of downstream compromise, including ransomware deployment.

No indicators of compromise (IPs, hashes, or malware samples) were included in this listing beyond the DNS records for the victim domain, which were not detailed in the article text.

## Mentioned in this report

- Vulnerabilities: CVE-2022-40684 (KEV)
- Threat actors: Krybit

## Detection guidance (public sample)

### FortiOS SSL-VPN Credential File Access via Authentication Bypass

ATT&CK: T1552.001

Detects suspicious file access patterns targeting FortiOS credential stores and configuration files through unauthenticated management interface requests, indicative of CVE-2022-40684 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiOS SSL-VPN Credential File Access via Authentication Bypass
description: Detects HTTP requests to FortiOS/FortiProxy management interfaces attempting
  to read sensitive credential and configuration files without prior authentication,
  characteristic of CVE-2022-40684 (FortiBleed) exploitation.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: proxy
  product: fortios
detection:
  selection:
    http_request_method: GET
    destination_port: 443
    http_uri|contains:
    - /api/v2/cmdb/
    - /cgi-bin/
    - /admin/
    http_uri|re: (passwd|credential|user|config|secret|key)
  filter_authenticated:
    http_headers|contains: 'Authorization:'
  condition: selection and not filter_authenticated
falsepositives:
- Legitimate FortiOS API calls with missing or malformed Authorization headers
- Automated scanning tools probing management interfaces
level: high
id: 0b80f19a-3971-5912-a6c0-a99c441e43c9
status: experimental
author: Vorant
```

### Lateral Movement from FortiOS VPN Appliance to Internal Hosts

ATT&CK: T1078

Detects network connections originating from FortiOS SSL-VPN management interfaces to internal hosts using harvested or reused credentials, following credential exposure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Lateral Movement from FortiOS VPN Appliance to Internal Hosts
description: Detects suspicious inbound connections to internal systems originating
  from FortiOS/FortiProxy SSL-VPN appliance IP addresses, indicative of lateral movement
  using exposed or reused credentials post-exploitation.
tags:
- attack.lateral-movement
- attack.t1078
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    source_ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    source_port: 443
    destination_port:
    - 22
    - 3389
    - 5985
    - 5986
    - 139
    - 445
    protocol: tcp
  filter_internal_vpn:
    source_hostname|contains: vpn
  condition: selection and not filter_internal_vpn
falsepositives:
- Legitimate VPN appliance-to-infrastructure management traffic
- Scheduled security patching or backup operations from VPN appliances
level: medium
id: 9d34d62a-5f04-5f95-a0d3-65e8cb0bafae
status: experimental
author: Vorant
```

### Unpatched FortiOS Version Continued Operation Post-Vulnerability Disclosure

ATT&CK: T1190

Detects FortiOS/FortiProxy versions vulnerable to CVE-2022-40684 still running after the 2022 patch deadline, indicating persistent exposure to credential extraction. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unpatched FortiOS Version Continued Operation Post-Vulnerability Disclosure
description: Identifies FortiOS/FortiProxy appliances running versions vulnerable
  to CVE-2022-40684 (FortiBleed) beyond the 2022 patch date, indicating organizations
  at continued risk of unauthenticated credential extraction via the management interface.
tags:
- attack.reconnaissance
- attack.t1190
logsource:
  category: network_connection
  product: fortios
detection:
  selection:
    destination_port: 443
    http_user_agent|contains: FortiGate
    http_response_headers|contains: 'Server:'
  version_vulnerable:
    http_response_body|re: FortiOS\s+(5\.6|6\.[0-3]|7\.[0-1])
  condition: selection and version_vulnerable
falsepositives:
- Air-gapped FortiOS appliances with patching deferred by design
- Test/lab environments running older FortiOS versions intentionally
level: medium
id: 5b47569f-fab0-58bc-8538-7b8d58918b28
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/bGFzdWx0YW5haG90ZWxzLmNvbUBrcnliaXQ=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/37e9ffe3-d7e5-5135-9a03-fad040a8b01c/fortinet-flaw-exposes-hotel-chain-to-krybit-ransomware.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup