# Clop ransomware claims Harley-Davidson compromise

Published: 2026-09-10 · Severity: severe · Sectors: manufacturing, retail
Canonical: https://vorant.io/reports/6d64dcc6-d939-50dd-9843-4291c06971e4/clop-ransomware-claims-harley-davidson-compromise

> Clop ransomware operators claim breach of Harley-Davidson via exposed FortiOS SSL-VPN credentials from FortiBleed.

Ransomware.live, a public tracker of ransomware operator claims, reports that the Clop ransomware gang has listed Harley-Davidson as a victim. According to the posting, the compromise involved 18 compromised employees and 2,828 compromised user accounts. The attackers also claim access to 38 third-party employee credentials and identified 105 items on the victim's external attack surface. The article notes that Harley-Davidson's FortiOS SSL-VPN credentials were exposed via the FortiBleed vulnerability (CVE-2022-40684), suggesting that credential exposure may have been the initial vector for compromise. This represents exploitation of known credential leaks to gain initial access to a high-profile target.

Defenders should note that FortiBleed (CVE-2022-40684) exposed authentication bypass capability in Fortinet FortiOS SSL-VPN, allowing unauthenticated attackers to access the management interface. The exposure of SSL-VPN credentials from this vulnerability has become a documented attack vector for ransomware operations. Organizations using Fortinet equipment should verify patch status and review VPN access logs for suspicious activity.

## Mentioned in this report

- Vulnerabilities: CVE-2022-40684 (KEV)
- Threat actors: Clop
- Malware: Clop

## Detection guidance (public sample)

### FortiOS Management API Authentication Bypass Attempt (CVE-2022-40684 Pattern)

ATT&CK: T1078.001

Detects HTTP requests to the FortiOS management API /api/v2/cmdb/ using the 'Report Runner' user agent, or PUT/POST requests to the admin configuration endpoint, which is the CVE-2022-40684 authentication bypass pattern used to obtain access to SSL-VPN and admin accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiOS Management API Authentication Bypass Attempt (CVE-2022-40684 Pattern)
description: Detects requests to the FortiOS management API (/api/v2/cmdb/) that use
  the 'Report Runner' user agent, or that modify admin accounts via PUT/POST, matching
  the CVE-2022-40684 authentication bypass abused to reach admin and SSL-VPN credentials.
  Requires web/proxy logs from the Fortinet management interface or a reverse proxy
  in front of it.
tags:
- attack.initial-access
- attack.stealth
- attack.persistence
- attack.t1078.001
logsource:
  category: webserver
detection:
  selection_ua:
    cs-user-agent: Report Runner
    cs-uri-stem|contains: /api/v2/cmdb/
  selection_admin_modify:
    cs-method:
    - PUT
    - POST
    cs-uri-stem|contains: /api/v2/cmdb/system/admin
  condition: 1 of selection_*
falsepositives:
- Legitimate administrators or automation (e.g. FortiManager or Ansible) modifying
  admin accounts via the REST API from known management hosts
- Authorised vulnerability scanners testing for CVE-2022-40684
level: high
id: 8bbfeb7d-ec33-5f2b-8b72-a33189d655a8
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/SEFSTEVZLURBVklEU09OLkNPTUBjbG9w
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/SEFSTEVZLURBVklEU09OLkNPTUBjbG9w

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6d64dcc6-d939-50dd-9843-4291c06971e4/clop-ransomware-claims-harley-davidson-compromise.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup