LockBit lists Indian firm via FortiBleed flaw

3 August 2026 high threat manufacturing

LockBit ransomware operators posted an Indian company as a victim, noting stolen FortiOS SSL-VPN credentials tied to the FortiBleed flaw.

Ransomware.live's tracker has added pcclimitedindia.com to LockBit's leak site listing. The associated data notes that credentials for the victim's FortiOS SSL-VPN were exposed through the previously disclosed "FortiBleed" vulnerability (CVE-2022-40684), suggesting this exposure may have contributed to initial access or lateral movement in the intrusion.

The listing includes minimal detail beyond compromised-employee counts and DNS records for the victim domain, consistent with a standard extortion posting rather than a full breach report. No stolen data samples or additional infrastructure details were disclosed in the source material.

This appears to be a routine addition to LockBit's ongoing victim disclosure operations rather than a novel technique or large-scale campaign, though the FortiBleed credential exposure underscores the continued risk of unpatched or previously-exploited Fortinet SSL-VPN appliances being leveraged by ransomware affiliates.

Mentioned in this report

Vulnerabilities CVE-2022-40684KEV

Threat actors LockBit

Malware LockBit

Detection guidance

FortiOS SSL-VPN Authentication Bypass via FortiBleed

ATT&CK T1190

Detects exploitation attempts against FortiOS SSL-VPN using CVE-2022-40684 (FortiBleed) - malformed HTTP requests with crafted headers bypassing authentication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: FortiOS SSL-VPN Authentication Bypass via FortiBleed
description: Detects potential exploitation of CVE-2022-40684 (FortiBleed) against
  FortiOS SSL-VPN endpoints. The vulnerability allows unauthenticated attackers to
  read sensitive files by sending specially crafted HTTP requests with path traversal
  and header manipulation.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: proxy
  product: fortinet
detection:
  selection_fortibleed:
    DestinationPort:
    - 443
    - 10443
    uri|contains:
    - /remote/fgt_lang
    - /remote/upload
    http_request_line|contains:
    - ..\
    - ../
    http_user_agent|contains:
    - Wget
    - curl
    - python-requests
  filter_legitimate_vpn:
    http_user_agent|contains:
    - Mozilla
    - Chrome
    - Safari
  condition: selection_fortibleed and not filter_legitimate_vpn
falsepositives:
- Legitimate VPN client software checking for updates
- Security scanning tools testing SSL-VPN endpoints with known CVE patterns
level: high
id: fd1994b1-ac86-54ca-acd3-111dda13bdbf
status: experimental
author: Vorant

FortiOS SSL-VPN Credential Exposure Detection

ATT&CK T1078

Detects extraction or exfiltration of VPN credentials from FortiOS SSL-VPN configuration or session state following FortiBleed exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: FortiOS SSL-VPN Credential Exposure Detection
description: Detects potential credential extraction from FortiOS SSL-VPN systems
  post-FortiBleed exploitation. Monitors for SSH/administrative access to Fortinet
  appliances combined with configuration file reads or credential dumps.
tags:
- attack.credential-access
- attack.t1078
logsource:
  category: process_creation
  product: windows
detection:
  selection_fortinet_config_access:
    CommandLine|contains:
    - system.conf
    - user
    - vpn
  selection_credential_dump:
    Image|endswith:
    - \\mimikatz.exe
    - \\procdump.exe
    CommandLine|contains:
    - lsass
    - credential
  filter_admin_tool:
    ParentImage|contains:
    - FortiClient
    - Administrative Tools
  condition: (selection_fortinet_config_access or selection_credential_dump) and not
    filter_admin_tool
falsepositives:
- Authorized system administrators backing up or migrating Fortinet configurations
- Incident response teams collecting forensic data with proper authorization
level: medium
id: 7aa5fc95-bdeb-5b0b-b178-32f552500ae8
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/cGNjbGltaXRlZGluZGlhLmNvbUBsb2NrYml0NQ==

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free