Argentine pharmacy hit by Gentlemen ransomware

7 September 2026 severe threat healthcareretail

Ransomware group 'The Gentlemen' listed pharmaceutical distributor Droguería Saporiti Sacifia as a victim, with exposure linked to a Fortinet FortiBleed VPN credential leak.

This is a victim-listing entry from ransomware.live documenting that the ransomware group known as "The Gentlemen" has added Argentine pharmaceutical/drugstore distributor Droguería Saporiti Sacifia to its leak site. The entry notes third-party employee credential exposure and flags that the victim's FortiOS SSL-VPN credentials were previously exposed via the FortiBleed leak (CVE-2022-40684), an authentication bypass vulnerability in Fortinet FortiOS/FortiProxy that allowed unauthenticated actors to access administrative interfaces and, in some cases, harvest SSL-VPN credentials. No specific indicators of compromise, malware samples, or exploitation timeline are provided in this listing.

While the entry provides limited technical detail, it is consistent with a broader pattern where ransomware actors leverage previously leaked or exposed VPN credentials—stemming from unpatched or historically vulnerable edge devices—to gain initial access to victim networks. Organizations using Fortinet SSL-VPN products should verify patching status against CVE-2022-40684 and rotate any credentials that may have been exposed via legacy FortiBleed-related leaks, as such exposures can remain exploitable long after public disclosure if credentials were never rotated.

Mentioned in this report

Vulnerabilities CVE-2022-40684KEV

Threat actors The Gentlemen

Malware Gentlemen

Detection guidance

FortiOS SSL-VPN Administrative Access via Unauthenticated Session

ATT&CK T1190

Detects unauthenticated access to FortiOS SSL-VPN administrative interfaces, exploiting CVE-2022-40684 authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: FortiOS SSL-VPN Administrative Access via Unauthenticated Session
description: Detects exploitation of CVE-2022-40684 - unauthenticated access to FortiOS/FortiProxy
  administrative interfaces without prior session establishment or credentials.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: network_connection
  product: fortios
detection:
  selection:
    DestinationPort: 443
    RequestPath|startswith:
    - /api/v2/
    - /admin/
    HttpMethod:
    - GET
    - POST
    AuthenticationRequired: false
    UserContext: null
  condition: selection
falsepositives:
- Authorized administrators accessing FortiOS dashboard over HTTPS prior to authentication
- Fortinet legitimate health-check probes from monitoring systems
level: critical
id: 3714cadd-6a08-5aaa-a516-ee463170a562
status: experimental
author: Vorant

Credential Harvesting from FortiOS Administrative Interface

ATT&CK T1190

Detects extraction or enumeration of SSL-VPN credentials from FortiOS configuration or session data via unauthenticated API access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Credential Harvesting from FortiOS Administrative Interface
description: Detects unauthenticated queries to FortiOS administrative APIs that enumerate
  or extract SSL-VPN user credentials or configuration secrets.
tags:
- attack.credential-access
- attack.t1190
logsource:
  category: network_connection
  product: fortios
detection:
  selection:
    DestinationPort: 443
    RequestPath|contains:
    - /api/v2/monitor/vpn/ssl
    - /api/v2/monitor/user
    - /api/v2/cmdb/user/ldap
    - /api/v2/cmdb/authentication/scheme
    HttpMethod: GET
    AuthenticationRequired: false
  condition: selection
falsepositives:
- Legitimate Fortinet API integration by authenticated administrators
- Vulnerability scanning by authorized security tools against FortiOS
level: high
id: 5e28fa2c-d8af-5d63-a656-5747aa29a808
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/RHJvZ3VlcmlhIFNhcG9yaXRpIFNhY2lmaWFAdGhlZ2VudGxlbWVu

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free