HYFLOCK ransomware claims Ecuador police breach
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Ransomware group HYFLOCK claims a breach of Ecuador's police headquarters, reportedly via FortiOS credentials exposed through the FortiBleed flaw.
Ransomware.live has indexed a victim listing from the ransomware group identifying itself as HYFLOCK, naming Ecuador's police headquarters (Policía Nacional) as a victim. The listing states that FortiOS SSL-VPN credentials belonging to the victim's domain were exposed via the 'FortiBleed' vulnerability, tracked as CVE-2022-40684, an authentication bypass in FortiOS/FortiProxy that allows unauthenticated attackers to read arbitrary files, including admin credentials, from vulnerable devices.
No further technical details, ransom note content, or sample data are provided beyond the victim identification and the vulnerability attribution. The entry appears to be a leak-site tracking record rather than original incident research; it provides no file hashes, C2 infrastructure, or TTP chain beyond the initial-access vector.
For defenders, the key actionable point is that the FortiBleed vulnerability (CVE-2022-40684), patched since 2022, continues to be leveraged by ransomware actors to harvest VPN credentials from unpatched FortiOS/FortiProxy appliances as an initial access vector. Organizations using Fortinet SSL-VPN products should confirm patch status, rotate credentials if exposure is suspected, and review VPN authentication logs for anomalous access.
Mentioned in this report
Detection guidance
FortiOS CVE-2022-40684 Auth Bypass - Report Runner User-Agent on Admin API
Detects requests to the FortiOS/FortiProxy REST admin API using the 'Report Runner' User-Agent, the known marker of CVE-2022-40684 authentication-bypass exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS CVE-2022-40684 Auth Bypass - Report Runner User-Agent on Admin API
description: Detects HTTP requests to the FortiOS/FortiProxy /api/v2/ management API
with the 'Report Runner' User-Agent, which is used to spoof an internal client and
bypass authentication (CVE-2022-40684). Exploitation allows reading admin credentials/config
or adding attacker SSH keys, enabling VPN credential theft.
tags:
- attack.initial-access
- attack.t1190
- attack.credential-access
- attack.t1552.001
- cve.2022-40684
logsource:
category: webserver
detection:
selection:
cs-user-agent|contains: Report Runner
cs-uri-stem|contains: /api/v2/
condition: selection
falsepositives:
- Legitimate internal Fortinet report or management components calling the local API
(rare and should originate from the device itself)
level: high
id: 2215cd96-0b72-57cc-b799-d98230d12d34
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/RWN1YWRvciBwb2xpY2UgaGVhZHF1YXJ0ZXJzQEhZRkxPQ0s=
FortiOS Admin Account Object Modified or Read via REST API cmdb Endpoint
Detects PUT/POST/GET requests to the FortiOS cmdb system admin API endpoint, which CVE-2022-40684 exploitation uses to read admin credentials or add attacker SSH keys. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS Admin Account Object Modified or Read via REST API cmdb Endpoint
description: Detects requests to /api/v2/cmdb/system/admin on FortiOS/FortiProxy management
interfaces. Exploitation of CVE-2022-40684 commonly issues a PUT to this endpoint
to add an SSH key to the admin account, or a GET to harvest admin configuration.
Review the source address and whether the request was authenticated; legitimate
API use should come from known admin hosts.
tags:
- attack.initial-access
- attack.t1190
- attack.credential-access
- attack.t1552.001
- cve.2022-40684
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /api/v2/cmdb/system/admin
cs-method:
- PUT
- POST
- GET
condition: selection
falsepositives:
- Legitimate administrators or automation (e.g. Ansible, FortiManager) using the REST
API from known management hosts
level: medium
id: 5b6788c3-c373-553d-932a-0f3b07708574
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/RWN1YWRvciBwb2xpY2UgaGVhZHF1YXJ0ZXJzQEhZRkxPQ0s=
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/RWN1YWRvciBwb2xpY2UgaGVhZHF1YXJ0ZXJzQEhZRkxPQ0s=
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs