# Krybit ransomware lists Brazilian eye clinic victim

Published: 2026-08-26 · Severity: high · Sectors: healthcare
Canonical: https://vorant.io/reports/becfc189-35e4-5cce-b5ea-026b6da7a8e9/krybit-ransomware-lists-brazilian-eye-clinic-victim

> Ransomware.live logged a Krybit ransomware group claim against Brazilian ophthalmology clinic neooftalmo.com.br, tied to exposed FortiOS SSL-VPN credentials.

This entry is a victim listing from the ransomware.live leak-site tracker rather than original research. It records that the ransomware group tracked as "Krybit" has claimed a victim at the domain www.neooftalmo.com.br, a Brazilian entity (based on the .com.br TLD, likely a healthcare/ophthalmology provider). The listing notes limited scope: one compromised employee, one compromised user, one set of third-party employee credentials, and two items of external attack surface exposure.

Of note for defenders, the listing states that the victim's FortiOS SSL-VPN credentials were exposed via the "FortiBleed" leak, referencing CVE-2022-40684, an authentication bypass vulnerability in FortiOS/FortiProxy that has been widely exploited since 2022 to harvest device credentials and configuration data. This suggests the initial access vector or a contributing exposure factor in this incident may trace back to unpatched or previously-exploited Fortinet infrastructure, a pattern consistent with numerous other ransomware intrusions where FortiGate credential leaks preceded a leak-site listing.

Given the sparse detail (a single victim, no confirmed data exfiltration content, and no technical indicators beyond the domain and referenced CVE), this should be treated as a low-confidence, low-volume incident report for situational awareness. Organizations running Fortinet SSL-VPN appliances should verify patch status against CVE-2022-40684 and rotate any credentials that may have been exposed via historical FortiOS leaks.

## Mentioned in this report

- Vulnerabilities: CVE-2022-40684 (KEV)
- Threat actors: Krybit
- Malware: Krybit

## Detection guidance (public sample)

### FortiOS SSL-VPN Credential Exposure via CVE-2022-40684

ATT&CK: T1552.001

Detects FortiOS/FortiProxy devices vulnerable to CVE-2022-40684 authentication bypass, which leaks SSL-VPN credentials and configuration data without authentication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiOS SSL-VPN Credential Exposure via CVE-2022-40684
description: 'Detects exploitation of CVE-2022-40684 in FortiOS/FortiProxy: unauthenticated
  HTTP POST requests to /api/v2/cmdb/system.password-policy or /api/v2/monitor/system/vdom-resource
  endpoints that bypass authentication and leak sensitive credentials or configuration.'
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: web_application_firewall
  product: fortinet
detection:
  selection_cve_2022_40684:
    http_method: POST
    http_uri|contains:
    - /api/v2/cmdb/system.password-policy
    - /api/v2/monitor/system/vdom-resource
    http_status: 200
    source_ip|contains|all:
    - '!127.0.0.1'
    authenticated_user: null
  filter_internal:
    source_ip|startswith:
    - 192.168.
    - '10.'
    - 172.16.
  condition: selection_cve_2022_40684 and not filter_internal
falsepositives:
- Legitimate automated credential rotation tools making unauthenticated API calls
  on patched appliances
- Vulnerability scanners testing for CVE-2022-40684 as part of authorized assessments
level: high
id: e7c97355-7434-5526-8c1a-89c7bd8b398a
status: experimental
author: Vorant
```

### Public-Facing Fortinet Appliance Exposed to the Internet

ATT&CK: T1190

Detects Fortinet SSL-VPN endpoints exposed on public IP addresses accessible from the internet without network segmentation, enabling direct exploitation attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Public-Facing Fortinet Appliance Exposed to the Internet
description: Detects FortiGate/FortiProxy appliances with SSL-VPN services (typically
  port 443, 8443, 10443) responding to external internet traffic without WAF or access-control
  restrictions, creating attack surface for CVE-2022-40684 and similar authentication-bypass
  vulnerabilities.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: network_connection
  product: fortinet
detection:
  selection_vpn_service:
    destination_port:
    - 443
    - 8443
    - 10443
    destination_hostname|endswith:
    - .neooftalmo.com.br
    - fortios
    - fortigate
    protocol: ssl/tls
  selection_external_source:
    source_ip|contains|all:
    - '!10.0.0.0/8'
    - '!172.16.0.0/12'
    - '!192.168.0.0/16'
  selection_no_geo_block:
    geo_source|contains:
    - CN
    - RU
    - KP
    - IR
  condition: selection_vpn_service and selection_external_source and selection_no_geo_block
falsepositives:
- Legitimate remote employees or partner organizations connecting from outside Brazil
- Authorized security researchers performing vulnerability assessments with vendor
  permission
level: medium
id: 0d57cb56-0ec0-5ef1-80de-93bd044a9a0b
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/d3d3Lm5lb29mdGFsbW8uY29tLmJyQGtyeWJpdA==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/becfc189-35e4-5cce-b5ea-026b6da7a8e9/krybit-ransomware-lists-brazilian-eye-clinic-victim.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup