Fort Smith, Arkansas exposed via FortiBleed VPN credentials
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
City of Fort Smith had FortiOS SSL-VPN credentials exposed in FortiBleed leak; 39 compromised accounts identified.
The City of Fort Smith, Arkansas was identified as a victim through the FortiBleed vulnerability (CVE-2022-40684), which exposed FortiOS SSL-VPN credentials. Security research identified 39 compromised user accounts associated with the city's domain, along with 15 items on the external attack surface. While the article does not detail an active ransomware deployment, it documents credential exposure that could enable lateral movement and unauthorized access to municipal systems. The exposure was disclosed through public ransomware tracking platforms and represents a significant risk to the municipality's IT infrastructure, particularly given SSL-VPN access typically grants broad network privileges. This case exemplifies how credential leaks from infrastructure vulnerabilities create downstream compromise risks.
Mentioned in this report
Detection guidance
FortiGate SSL-VPN Login Failure Burst Indicative of Brute Force
FortiGate SSL-VPN login failure events; alert when many occur for one user or source in a short window. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiGate SSL-VPN Login Failure Burst Indicative of Brute Force
description: Detects FortiGate SSL-VPN login failure events. Individual events are
low signal; tune the SIEM to alert when a single source IP or many usernames produce
a high number of failures within a few minutes (password guessing or spraying against
exposed VPN accounts).
tags:
- attack.credential-access
- attack.t1110
logsource:
product: fortigate
service: event
detection:
selection:
logdesc|contains: SSL VPN login fail
selection_action:
action: ssl-login-fail
condition: 1 of selection*
falsepositives:
- Users mistyping passwords or using expired credentials after a password change
- Misconfigured VPN clients retrying with stale saved credentials
level: medium
id: 218e8ab8-1dee-5126-995c-72797fdb6110
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/Q2l0eSBvZiBGb3J0IFNtaXRoIEFya2Fuc2FzQGludGVybG9jaw==
FortiOS Admin API Auth Bypass Attempt (CVE-2022-40684 Pattern)
HTTP PUT to the FortiOS admin cmdb API with the Report Runner user agent, the known CVE-2022-40684 auth bypass pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS Admin API Auth Bypass Attempt (CVE-2022-40684 Pattern)
description: Detects HTTP requests to the FortiOS cmdb admin API using the Report
Runner user agent, a known CVE-2022-40684 authentication bypass pattern. It is used
to modify admin accounts (for example adding an SSH key) and expose or abuse VPN
credentials.
tags:
- attack.initial-access
- attack.t1078.001
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-user-agent|contains: Report Runner
cs-uri-stem|contains: /api/v2/cmdb/system/admin
selection_method:
cs-method:
- PUT
- POST
condition: selection and selection_method
falsepositives:
- Authorised vulnerability scanners probing for CVE-2022-40684
level: high
id: d52d8c92-059a-5a5b-933e-ece56dfc2f9d
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/Q2l0eSBvZiBGb3J0IFNtaXRoIEFya2Fuc2FzQGludGVybG9jaw==
FortiGate SSL-VPN Tunnel Established by Default or Generic Account Name
SSL-VPN tunnel established under a default or generic account name such as admin, administrator, guest or test. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiGate SSL-VPN Tunnel Established by Default or Generic Account Name
description: Detects successful FortiGate SSL-VPN tunnel establishment by default
or generic account names (admin, administrator, guest, test). Such accounts are
rarely legitimate VPN users and suggest use of leaked or default credentials for
trusted-relationship style access.
tags:
- attack.initial-access
- attack.t1078.001
- attack.t1199
logsource:
product: fortigate
service: event
detection:
selection:
logdesc|contains: SSL VPN tunnel up
user:
- admin
- administrator
- guest
- test
- user
condition: selection
falsepositives:
- Lab or test FortiGate deployments that deliberately use generic VPN accounts
- Administrators temporarily testing VPN connectivity with a default account
level: medium
id: 884a2ecd-12c1-54fa-8857-ed91309d90d7
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/Q2l0eSBvZiBGb3J0IFNtaXRoIEFya2Fuc2FzQGludGVybG9jaw==
2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/Q2l0eSBvZiBGb3J0IFNtaXRoIEFya2Fuc2FzQGludGVybG9jaw==
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs