# EP Manufacturing compromised via FortiBleed VPN flaw

Published: 2026-08-31 · Severity: elevated · Sectors: manufacturing
Canonical: https://vorant.io/reports/b60344fd-df7b-59a1-ab24-caa194c9619e/ep-manufacturing-compromised-via-fortibleed-vpn-flaw

> Malaysian manufacturer EP Manufacturing Bhd exposed to ransomware attack via FortiOS SSL-VPN credentials leaked in FortiBleed vulnerability.

EP Manufacturing Bhd, a Malaysian manufacturing company, has been identified as compromised following exposure of FortiOS SSL-VPN credentials through the FortiBleed vulnerability (CVE-2022-40684). According to ransomware.live tracking, the compromise resulted in at least 5 compromised employees and 10 third-party employee credentials being exposed, along with 2 points of external attack surface. The FortiBleed vulnerability allows unauthenticated attackers to retrieve sensitive information including usernames and passwords from affected FortiOS SSL-VPN appliances.

This incident demonstrates the ongoing risk posed by FortiBleed exploitation, which has been actively leveraged in the wild since its disclosure. The leaked VPN credentials provide attackers direct access to corporate networks, enabling lateral movement, data exfiltration, and potential ransomware deployment. The presence of third-party employee credentials suggests the compromise may have extended to supply chain contacts or managed service providers.

## Mentioned in this report

- Vulnerabilities: CVE-2022-40684 (KEV)

## Detection guidance (public sample)

### Net Use Mapping Admin Share With Explicit Credentials

ATT&CK: T1021.002

Detects net.exe/net1.exe mapping a remote administrative share (ADMIN$, C$, D$) with explicit /user: credentials, a pattern used for lateral movement with stolen VPN or domain credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Net Use Mapping Admin Share With Explicit Credentials
description: Detects net.exe or net1.exe mapping a remote administrative share (ADMIN$,
  C$, D$) while supplying explicit credentials via /user:. Typical of lateral movement
  using stolen credentials after VPN access.
tags:
- attack.lateral-movement
- attack.t1021.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \net.exe
    - \net1.exe
  selection_use:
    CommandLine|contains: ' use '
  selection_share:
    CommandLine|contains:
    - \ADMIN$
    - \C$
    - \D$
  selection_creds:
    CommandLine|contains: '/user:'
  condition: all of selection_*
falsepositives:
- Administrators or deployment scripts mapping admin shares with alternate credentials
  for patching or software distribution
- Backup jobs that connect to C$ with a service account
level: medium
id: 71900db2-6cb8-5f80-9724-a7c9b6141151
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/RVAgTWFudWZhY3R1cmluZyBCaGRAdGhlZ2VudGxlbWVu
```

### VNC Server or Viewer Executed From Process Creation

ATT&CK: T1021.005

Detects execution of common VNC server/viewer binaries (WinVNC, UltraVNC, TightVNC, TigerVNC, RealVNC) which attackers use for remote interactive access after obtaining VPN credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: VNC Server or Viewer Executed From Process Creation
description: Detects execution of common VNC server or viewer binaries, which attackers
  use for interactive lateral movement and remote access after gaining network access
  through leaked VPN credentials. Review in environments where VNC is not an approved
  remote support tool.
tags:
- attack.lateral-movement
- attack.t1021.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \winvnc.exe
    - \winvnc4.exe
    - \tvnserver.exe
    - \tvnviewer.exe
    - \vncviewer.exe
    - \vncserver.exe
    - \vncserverui.exe
    - \vncviewer64.exe
  condition: selection
falsepositives:
- Approved IT helpdesk or industrial control tooling that uses VNC for remote support
level: medium
id: 442500b7-f168-51da-a4ed-ec3c694c18dc
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/RVAgTWFudWZhY3R1cmluZyBCaGRAdGhlZ2VudGxlbWVu
```

### Remote Access To Administrative Share From Non-Local Source

ATT&CK: T1021.002

Detects network access to ADMIN$ or C$ shares from a remote address, reflecting SMB lateral movement with valid accounts; requires file share auditing (event 5140). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Remote Access To Administrative Share From Non-Local Source
description: Detects network share access events (5140) to ADMIN$, C$ or D$ originating
  from a remote address by a non-machine account. Indicates SMB admin share lateral
  movement using valid credentials. Requires Audit File Share to be enabled and is
  best tuned against known admin hosts.
tags:
- attack.lateral-movement
- attack.t1021.002
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5140
    ShareName|endswith:
    - \ADMIN$
    - \C$
    - \D$
  filter_local:
    IpAddress:
    - 127.0.0.1
    - ::1
  filter_machine:
    SubjectUserName|endswith: $
  condition: selection and not 1 of filter_*
falsepositives:
- Domain administrators, backup software and patch management servers accessing admin
  shares
- Vulnerability scanners using authenticated scans
level: low
id: 01599b18-693d-5647-89f5-545fea0469bc
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/RVAgTWFudWZhY3R1cmluZyBCaGRAdGhlZ2VudGxlbWVu
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/RVAgTWFudWZhY3R1cmluZyBCaGRAdGhlZ2VudGxlbWVu

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b60344fd-df7b-59a1-ab24-caa194c9619e/ep-manufacturing-compromised-via-fortibleed-vpn-flaw.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup