EP Manufacturing compromised via FortiBleed VPN flaw
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Malaysian manufacturer EP Manufacturing Bhd exposed to ransomware attack via FortiOS SSL-VPN credentials leaked in FortiBleed vulnerability.
EP Manufacturing Bhd, a Malaysian manufacturing company, has been identified as compromised following exposure of FortiOS SSL-VPN credentials through the FortiBleed vulnerability (CVE-2022-40684). According to ransomware.live tracking, the compromise resulted in at least 5 compromised employees and 10 third-party employee credentials being exposed, along with 2 points of external attack surface. The FortiBleed vulnerability allows unauthenticated attackers to retrieve sensitive information including usernames and passwords from affected FortiOS SSL-VPN appliances.
This incident demonstrates the ongoing risk posed by FortiBleed exploitation, which has been actively leveraged in the wild since its disclosure. The leaked VPN credentials provide attackers direct access to corporate networks, enabling lateral movement, data exfiltration, and potential ransomware deployment. The presence of third-party employee credentials suggests the compromise may have extended to supply chain contacts or managed service providers.
Mentioned in this report
Detection guidance
Net Use Mapping Admin Share With Explicit Credentials
Detects net.exe/net1.exe mapping a remote administrative share (ADMIN$, C$, D$) with explicit /user: credentials, a pattern used for lateral movement with stolen VPN or domain credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Net Use Mapping Admin Share With Explicit Credentials
description: Detects net.exe or net1.exe mapping a remote administrative share (ADMIN$,
C$, D$) while supplying explicit credentials via /user:. Typical of lateral movement
using stolen credentials after VPN access.
tags:
- attack.lateral-movement
- attack.t1021.002
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \net.exe
- \net1.exe
selection_use:
CommandLine|contains: ' use '
selection_share:
CommandLine|contains:
- \ADMIN$
- \C$
- \D$
selection_creds:
CommandLine|contains: '/user:'
condition: all of selection_*
falsepositives:
- Administrators or deployment scripts mapping admin shares with alternate credentials
for patching or software distribution
- Backup jobs that connect to C$ with a service account
level: medium
id: 71900db2-6cb8-5f80-9724-a7c9b6141151
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/RVAgTWFudWZhY3R1cmluZyBCaGRAdGhlZ2VudGxlbWVu
VNC Server or Viewer Executed From Process Creation
Detects execution of common VNC server/viewer binaries (WinVNC, UltraVNC, TightVNC, TigerVNC, RealVNC) which attackers use for remote interactive access after obtaining VPN credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: VNC Server or Viewer Executed From Process Creation
description: Detects execution of common VNC server or viewer binaries, which attackers
use for interactive lateral movement and remote access after gaining network access
through leaked VPN credentials. Review in environments where VNC is not an approved
remote support tool.
tags:
- attack.lateral-movement
- attack.t1021.005
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \winvnc.exe
- \winvnc4.exe
- \tvnserver.exe
- \tvnviewer.exe
- \vncviewer.exe
- \vncserver.exe
- \vncserverui.exe
- \vncviewer64.exe
condition: selection
falsepositives:
- Approved IT helpdesk or industrial control tooling that uses VNC for remote support
level: medium
id: 442500b7-f168-51da-a4ed-ec3c694c18dc
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/RVAgTWFudWZhY3R1cmluZyBCaGRAdGhlZ2VudGxlbWVu
Remote Access To Administrative Share From Non-Local Source
Detects network access to ADMIN$ or C$ shares from a remote address, reflecting SMB lateral movement with valid accounts; requires file share auditing (event 5140). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Remote Access To Administrative Share From Non-Local Source
description: Detects network share access events (5140) to ADMIN$, C$ or D$ originating
from a remote address by a non-machine account. Indicates SMB admin share lateral
movement using valid credentials. Requires Audit File Share to be enabled and is
best tuned against known admin hosts.
tags:
- attack.lateral-movement
- attack.t1021.002
logsource:
product: windows
service: security
detection:
selection:
EventID: 5140
ShareName|endswith:
- \ADMIN$
- \C$
- \D$
filter_local:
IpAddress:
- 127.0.0.1
- ::1
filter_machine:
SubjectUserName|endswith: $
condition: selection and not 1 of filter_*
falsepositives:
- Domain administrators, backup software and patch management servers accessing admin
shares
- Vulnerability scanners using authenticated scans
level: low
id: 01599b18-693d-5647-89f5-545fea0469bc
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/RVAgTWFudWZhY3R1cmluZyBCaGRAdGhlZ2VudGxlbWVu
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/RVAgTWFudWZhY3R1cmluZyBCaGRAdGhlZ2VudGxlbWVu
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs