Clop ransomware claims Harley-Davidson compromise
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Clop ransomware operators claim breach of Harley-Davidson via exposed FortiOS SSL-VPN credentials from FortiBleed.
Ransomware.live, a public tracker of ransomware operator claims, reports that the Clop ransomware gang has listed Harley-Davidson as a victim. According to the posting, the compromise involved 18 compromised employees and 2,828 compromised user accounts. The attackers also claim access to 38 third-party employee credentials and identified 105 items on the victim's external attack surface. The article notes that Harley-Davidson's FortiOS SSL-VPN credentials were exposed via the FortiBleed vulnerability (CVE-2022-40684), suggesting that credential exposure may have been the initial vector for compromise. This represents exploitation of known credential leaks to gain initial access to a high-profile target.
Defenders should note that FortiBleed (CVE-2022-40684) exposed authentication bypass capability in Fortinet FortiOS SSL-VPN, allowing unauthenticated attackers to access the management interface. The exposure of SSL-VPN credentials from this vulnerability has become a documented attack vector for ransomware operations. Organizations using Fortinet equipment should verify patch status and review VPN access logs for suspicious activity.
Mentioned in this report
Detection guidance
FortiOS Management API Authentication Bypass Attempt (CVE-2022-40684 Pattern)
Detects HTTP requests to the FortiOS management API /api/v2/cmdb/ using the 'Report Runner' user agent, or PUT/POST requests to the admin configuration endpoint, which is the CVE-2022-40684 authentication bypass pattern used to obtain access to SSL-VPN and admin accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS Management API Authentication Bypass Attempt (CVE-2022-40684 Pattern)
description: Detects requests to the FortiOS management API (/api/v2/cmdb/) that use
the 'Report Runner' user agent, or that modify admin accounts via PUT/POST, matching
the CVE-2022-40684 authentication bypass abused to reach admin and SSL-VPN credentials.
Requires web/proxy logs from the Fortinet management interface or a reverse proxy
in front of it.
tags:
- attack.initial-access
- attack.stealth
- attack.persistence
- attack.t1078.001
logsource:
category: webserver
detection:
selection_ua:
cs-user-agent: Report Runner
cs-uri-stem|contains: /api/v2/cmdb/
selection_admin_modify:
cs-method:
- PUT
- POST
cs-uri-stem|contains: /api/v2/cmdb/system/admin
condition: 1 of selection_*
falsepositives:
- Legitimate administrators or automation (e.g. FortiManager or Ansible) modifying
admin accounts via the REST API from known management hosts
- Authorised vulnerability scanners testing for CVE-2022-40684
level: high
id: 8bbfeb7d-ec33-5f2b-8b72-a33189d655a8
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/SEFSTEVZLURBVklEU09OLkNPTUBjbG9w
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/SEFSTEVZLURBVklEU09OLkNPTUBjbG9w
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs