# LockBit5 lists hygear.com via FortiBleed flaw

Published: 2026-09-18 · Severity: elevated
Canonical: https://vorant.io/reports/4602e997-7c00-56ae-b745-ea75b548b471/lockbit5-lists-hygear-com-via-fortibleed-flaw

> LockBit5 ransomware group posted hygear.com as a victim, noting FortiOS SSL-VPN credentials were exposed through the FortiBleed flaw (CVE-2022-40684).

Ransomware.live's leak-site tracker recorded a new victim entry attributed to the LockBit5 ransomware operation: hygear.com. The listing states that the victim's FortiOS SSL-VPN credentials were exposed via the previously disclosed "FortiBleed" vulnerability (CVE-2022-40684), an authentication bypass in FortiOS/FortiProxy that allows unauthenticated attackers to read arbitrary files, including admin credentials, via crafted HTTP/HTTPS requests to the administrative interface. This suggests initial access or credential harvesting via unpatched Fortinet appliances rather than a novel intrusion technique.

No additional victim data, ransom note content, or exfiltrated file samples are included in this listing beyond the leak-site screenshot reference. Defenders operating Fortinet SSL-VPN/FortiOS or FortiProxy devices should verify patch status against CVE-2022-40684, rotate any credentials that may have been exposed on vulnerable devices, and review VPN/admin authentication logs for anomalous access originating around the time the flaw was disclosed. Organizations should also treat any residual unpatched FortiOS SSL-VPN instances as high-priority remediation items given their continued use as an initial-access vector by ransomware affiliates.

## Mentioned in this report

- Vulnerabilities: CVE-2022-40684 (KEV)
- Threat actors: LockBit
- Malware: LockBit

## Detection guidance (public sample)

### FortiOS Administrative Interface File Read via HTTP/HTTPS

ATT&CK: T1190

Detects HTTP/HTTPS requests to FortiOS/FortiProxy administrative interface endpoints indicative of CVE-2022-40684 exploitation - unauthenticated file read attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiOS Administrative Interface File Read via HTTP/HTTPS
description: Detects HTTP/HTTPS requests to FortiOS/FortiProxy admin interface attempting
  to read arbitrary files without authentication, consistent with CVE-2022-40684 (FortiBleed)
  exploitation. Triggers on suspicious URI patterns targeting admin endpoints and
  file paths.
tags:
- attack.t1190
logsource:
  category: proxy
  product: fortigate
detection:
  selection:
    dst_ip|endswith:
    - :443
    - :8443
    http_request_uri|contains:
    - /api/
    - /admin/
    http_method: GET
    http_status_code:
    - 200
    - 206
  filter_authenticated:
    http_user|exists: true
  condition: selection and not filter_authenticated
falsepositives:
- Legitimate admin API calls with session tokens missing from logs
- Internal vulnerability scanning tools targeting known admin endpoints
level: high
id: 14da5184-b468-5e23-bb38-368af7eb1c5e
status: experimental
author: Vorant
```

### Credential Extraction from FortiOS Configuration Files

ATT&CK: T1552.001

Detects unauthorized access to FortiOS configuration files containing credentials via unauthenticated HTTP requests, consistent with CVE-2022-40684 file-read exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Credential Extraction from FortiOS Configuration Files
description: Detects HTTP GET requests to FortiOS/FortiProxy file paths that store
  administrative credentials and configuration, exploitable via CVE-2022-40684 without
  authentication. Targets common paths where admin/VPN credentials are stored.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: proxy
  product: fortigate
detection:
  selection:
    http_method: GET
    http_request_uri|contains:
    - system.conf
    - admin-profile
    - user-profile
    - vpn-certificate
    - /api/v2/cmdb/system
    dst_ip|endswith:
    - :443
    - :8443
  filter_authenticated:
    http_user|exists: true
  condition: selection and not filter_authenticated
falsepositives:
- Legitimate credential rotation scripts with session context lost in logs
- Internal asset discovery tools reading config endpoints with implicit auth
level: high
id: a8049b2f-6c70-541c-8ea4-7ed9dc96c0d8
status: experimental
author: Vorant
```

### Unauthenticated FortiOS Admin Portal Access Pattern

ATT&CK: T1190

Detects repeated unauthenticated HTTP/HTTPS requests to FortiOS administrative UI endpoints, characteristic of CVE-2022-40684 exploitation reconnaissance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unauthenticated FortiOS Admin Portal Access Pattern
description: Detects multiple HTTP/HTTPS requests to FortiOS/FortiProxy admin UI without
  authentication headers or valid session tokens, consistent with CVE-2022-40684 enumeration
  and file-read exploitation attempts.
tags:
- attack.t1190
logsource:
  category: proxy
  product: fortigate
detection:
  selection:
    dst_ip|endswith:
    - :443
    - :8443
    http_request_uri|startswith:
    - /admin
    - /api/v2/cmdb
    http_status_code:
    - 200
    - 206
  filter_has_auth:
    http_authorization|exists: true
  filter_has_session:
    http_cookie|contains: FORTIOS_SESSION
  condition: selection and not filter_has_auth and not filter_has_session
falsepositives:
- Misconfigured proxy logs missing session cookie context
- Internal network diagnostics tools scanning admin endpoints without explicit auth
  logging
level: medium
id: 3726ef8d-ba42-5cad-ad7c-ac31ea8daaff
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/aHlnZWFyLmNvbUBsb2NrYml0NQ==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4602e997-7c00-56ae-b745-ea75b548b471/lockbit5-lists-hygear-com-via-fortibleed-flaw.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup