LockBit5 lists hygear.com via FortiBleed flaw
LockBit5 ransomware group posted hygear.com as a victim, noting FortiOS SSL-VPN credentials were exposed through the FortiBleed flaw (CVE-2022-40684).
Ransomware.live's leak-site tracker recorded a new victim entry attributed to the LockBit5 ransomware operation: hygear.com. The listing states that the victim's FortiOS SSL-VPN credentials were exposed via the previously disclosed "FortiBleed" vulnerability (CVE-2022-40684), an authentication bypass in FortiOS/FortiProxy that allows unauthenticated attackers to read arbitrary files, including admin credentials, via crafted HTTP/HTTPS requests to the administrative interface. This suggests initial access or credential harvesting via unpatched Fortinet appliances rather than a novel intrusion technique.
No additional victim data, ransom note content, or exfiltrated file samples are included in this listing beyond the leak-site screenshot reference. Defenders operating Fortinet SSL-VPN/FortiOS or FortiProxy devices should verify patch status against CVE-2022-40684, rotate any credentials that may have been exposed on vulnerable devices, and review VPN/admin authentication logs for anomalous access originating around the time the flaw was disclosed. Organizations should also treat any residual unpatched FortiOS SSL-VPN instances as high-priority remediation items given their continued use as an initial-access vector by ransomware affiliates.
Mentioned in this report
Detection guidance
FortiOS Administrative Interface File Read via HTTP/HTTPS
Detects HTTP/HTTPS requests to FortiOS/FortiProxy administrative interface endpoints indicative of CVE-2022-40684 exploitation - unauthenticated file read attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS Administrative Interface File Read via HTTP/HTTPS
description: Detects HTTP/HTTPS requests to FortiOS/FortiProxy admin interface attempting
to read arbitrary files without authentication, consistent with CVE-2022-40684 (FortiBleed)
exploitation. Triggers on suspicious URI patterns targeting admin endpoints and
file paths.
tags:
- attack.t1190
logsource:
category: proxy
product: fortigate
detection:
selection:
dst_ip|endswith:
- :443
- :8443
http_request_uri|contains:
- /api/
- /admin/
http_method: GET
http_status_code:
- 200
- 206
filter_authenticated:
http_user|exists: true
condition: selection and not filter_authenticated
falsepositives:
- Legitimate admin API calls with session tokens missing from logs
- Internal vulnerability scanning tools targeting known admin endpoints
level: high
id: 14da5184-b468-5e23-bb38-368af7eb1c5e
status: experimental
author: Vorant
Credential Extraction from FortiOS Configuration Files
Detects unauthorized access to FortiOS configuration files containing credentials via unauthenticated HTTP requests, consistent with CVE-2022-40684 file-read exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Credential Extraction from FortiOS Configuration Files
description: Detects HTTP GET requests to FortiOS/FortiProxy file paths that store
administrative credentials and configuration, exploitable via CVE-2022-40684 without
authentication. Targets common paths where admin/VPN credentials are stored.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
category: proxy
product: fortigate
detection:
selection:
http_method: GET
http_request_uri|contains:
- system.conf
- admin-profile
- user-profile
- vpn-certificate
- /api/v2/cmdb/system
dst_ip|endswith:
- :443
- :8443
filter_authenticated:
http_user|exists: true
condition: selection and not filter_authenticated
falsepositives:
- Legitimate credential rotation scripts with session context lost in logs
- Internal asset discovery tools reading config endpoints with implicit auth
level: high
id: a8049b2f-6c70-541c-8ea4-7ed9dc96c0d8
status: experimental
author: Vorant
Unauthenticated FortiOS Admin Portal Access Pattern
Detects repeated unauthenticated HTTP/HTTPS requests to FortiOS administrative UI endpoints, characteristic of CVE-2022-40684 exploitation reconnaissance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated FortiOS Admin Portal Access Pattern
description: Detects multiple HTTP/HTTPS requests to FortiOS/FortiProxy admin UI without
authentication headers or valid session tokens, consistent with CVE-2022-40684 enumeration
and file-read exploitation attempts.
tags:
- attack.t1190
logsource:
category: proxy
product: fortigate
detection:
selection:
dst_ip|endswith:
- :443
- :8443
http_request_uri|startswith:
- /admin
- /api/v2/cmdb
http_status_code:
- 200
- 206
filter_has_auth:
http_authorization|exists: true
filter_has_session:
http_cookie|contains: FORTIOS_SESSION
condition: selection and not filter_has_auth and not filter_has_session
falsepositives:
- Misconfigured proxy logs missing session cookie context
- Internal network diagnostics tools scanning admin endpoints without explicit auth
logging
level: medium
id: 3726ef8d-ba42-5cad-ad7c-ac31ea8daaff
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/aHlnZWFyLmNvbUBsb2NrYml0NQ==
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free