BOMOHSA suffers credential exposure via FortiBleed
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
BOMOHSA organization exposed FortiOS SSL-VPN credentials via CVE-2022-40684, with multiple user and employee credentials compromised.
BOMOHSA (gunra) has been identified as a victim of credential exposure through the FortiBleed vulnerability (CVE-2022-40684) affecting FortiOS SSL-VPN. The incident resulted in the compromise of 2 user accounts, 11 third-party employee credentials, and exposure of the organization's external attack surface. FortiOS SSL-VPN credentials were leaked as part of the broader FortiBleed disclosure. This represents a significant attack surface expansion, as compromised VPN credentials can be leveraged for unauthorized remote access, lateral movement, and potential ransomware deployment. The exposure suggests the organization may be at elevated risk for follow-on compromise if threat actors exploit the leaked credentials to gain initial access to internal systems.
Mentioned in this report
Detection guidance
FortiOS Admin API Access With Report Runner User-Agent (CVE-2022-40684)
Detects requests to the FortiOS REST API with the 'Report Runner' user-agent or admin-object modification via the API, the auth-bypass pattern of CVE-2022-40684 used to expose or add credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS Admin API Access With Report Runner User-Agent (CVE-2022-40684)
description: Detects FortiOS REST API requests using the Report Runner user-agent,
or PUT/POST changes to the system admin object, matching CVE-2022-40684 authentication
bypass abuse that exposes or alters administrative credentials and SSH keys.
tags:
- attack.initial-access
- attack.t1199
- attack.t1078.001
- cve.2022-40684
logsource:
category: webserver
detection:
selection_ua:
cs-user-agent|contains: Report Runner
cs-uri-stem|contains: /api/v2/
selection_admin_change:
cs-uri-stem|contains: /api/v2/cmdb/system/admin
cs-method:
- PUT
- POST
condition: 1 of selection_*
falsepositives:
- Legitimate FortiManager or FortiAnalyzer report jobs that use the Report Runner
agent against the API
- Authorised automation that manages FortiOS admin accounts via the REST API
level: high
id: 08a2e377-b974-5ddd-90e4-4dee046aeb75
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/Qk9NT0hTQUBndW5yYQ==
FortiOS SSL-VPN Tunnel Established by Default or Generic Account
Detects successful SSL-VPN tunnel establishment by default or generic account names, consistent with leaked credentials being reused for remote access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS SSL-VPN Tunnel Established by Default or Generic Account
description: Detects a successful FortiOS SSL-VPN tunnel-up event for default or generic
account names such as admin, administrator, guest, root or test, which suggests
reuse of leaked credentials for VPN access.
tags:
- attack.initial-access
- attack.persistence
- attack.t1078.001
logsource:
product: fortios
service: sslvpnd
detection:
selection:
action: tunnel-up
user:
- admin
- administrator
- guest
- root
- test
condition: selection
falsepositives:
- Organisations that still use a shared generic VPN account for vendor or contractor
access
level: medium
id: df7b66ad-fbd8-5b52-823d-559b1cab3799
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/Qk9NT0hTQUBndW5yYQ==
FortiOS SSL-VPN Login Failures Indicating Credential Stuffing
Detects FortiOS SSL-VPN login failure events. Alert on a high count from one source across multiple users, as in credential stuffing with leaked lists. Threshold must be applied in the SIEM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS SSL-VPN Login Failures Indicating Credential Stuffing
description: Detects FortiOS SSL-VPN login failure events. Apply a threshold in the
SIEM, for example more than 10 failures or many distinct users from one source IP
within 10 minutes, to find credential stuffing with leaked VPN credentials.
tags:
- attack.reconnaissance
- attack.t1589.001
- attack.credential-access
logsource:
product: fortios
service: sslvpnd
detection:
selection:
action: ssl-login-fail
condition: selection
falsepositives:
- Users mistyping passwords or using expired passwords after a rotation
- Misconfigured VPN clients retrying with stale saved credentials
level: low
id: cc1a5688-5af4-530d-9ac2-6804086c78dc
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/Qk9NT0hTQUBndW5yYQ==
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/Qk9NT0hTQUBndW5yYQ==
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs