TheGentlemen ransomware victim tied to FortiBleed leak

30 August 2026 high threat

A victim listed by the TheGentlemen ransomware group had FortiOS SSL-VPN credentials exposed via the 2022 FortiBleed flaw (CVE-2022-40684).

This entry from ransomware.live documents a victim attributed to a ransomware group referred to as "TheGentlemen" (victim alias "Nutrypollo"). The listing notes that the victim's FortiOS SSL-VPN credentials were exposed through the previously disclosed "FortiBleed" authentication bypass vulnerability (CVE-2022-40684), which affects Fortinet FortiOS and FortiProxy appliances and allows an unauthenticated attacker to retrieve sensitive files including credentials.

No additional technical detail, malware indicators, or exploitation narrative is provided in the source; the page functions as a victim-tracking index entry rather than an incident writeup. Defenders operating Fortinet SSL-VPN appliances should confirm patch status against CVE-2022-40684 and rotate any credentials that may have been exposed via unpatched devices, as compromised VPN credentials are a common initial access vector leveraged by ransomware affiliates.

Mentioned in this report

Vulnerabilities CVE-2022-40684KEV

Threat actors The Gentlemen

Detection guidance

FortiOS SSL-VPN Credential Extraction via CVE-2022-40684

ATT&CK T1190

Detects unauthenticated access to FortiOS sensitive file endpoints that bypass authentication via CVE-2022-40684, indicative of FortiBleed exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: FortiOS SSL-VPN Credential Extraction via CVE-2022-40684
description: Detects unauthenticated HTTP requests to FortiOS SSL-VPN endpoints that
  expose sensitive files (credentials, configuration) via the FortiBleed authentication
  bypass (CVE-2022-40684). Targets the distinctive URI paths that leak /api/v2/monitor/system/config/backup
  or similar sensitive endpoints without valid session tokens.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: proxy
  product: fortios
detection:
  selection_request:
    c_uri|contains:
    - /api/v2/monitor/system/config/backup
    - /api/v2/monitor/system/vdom-resource
    - /api/v2/cmdb/system/admin
    cs_method: GET
  selection_no_auth:
    cs_cookie: ''
  selection_response:
    sc_status: 200
  condition: selection_request and selection_no_auth and selection_response
falsepositives:
- Authenticated administrative queries to legitimate monitoring endpoints
- Vulnerability scanning tools with known FortiOS test cases
level: critical
id: fb34b552-1fec-5ae9-8213-07b009ddc5e1
status: experimental
author: Vorant

Successful Login with FortiOS VPN Credential Following Exposure

ATT&CK T1078

Detects successful VPN authentication attempts using credentials previously exposed through FortiBleed exploitation, correlating compromised credential reuse. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Successful Login with FortiOS VPN Credential Following Exposure
description: Detects successful SSL-VPN login events on FortiOS appliances where the
  source IP or login attempt exhibits patterns consistent with external ransomware
  actor activity post-credential-exposure. Focuses on successful authentication (event
  code indicating login success) following known FortiBleed disclosure periods or
  high-risk source indicators.
tags:
- attack.initial-access
- attack.t1078
logsource:
  category: authentication
  product: fortios
detection:
  selection_success:
    EventID: sslvpn_auth_success
    user|exists: true
  selection_external:
    src_ip|startswith:
    - '10.'
    - 172.16.
    - 192.168.
    negated: true
  filter_expected:
    user|contains:
    - admin
    - service
  condition: selection_success and selection_external and not filter_expected
falsepositives:
- Legitimate remote workers connecting from dynamic public IPs
- Authorized third-party vendor access via VPN
level: medium
id: 0b375599-a45d-5b6b-b89c-ce422ec9ae94
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/TnV0cnlwb2xsb0B0aGVnZW50bGVtZW4=

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free