Threat Intelligence Brief
Curated summary with source attribution
Source: ransomware.live
Threat Risk: High
Victim: ProHealth.sg
Incident: Exposure of FortiOS SSL-VPN credentials via the FortiBleed leak.
Impact: Unauthorized network access could lead to full system compromise or ransomware deployment.
Attacker: Unidentified threat actors
Analysis: The incident involves the exposure of sensitive VPN credentials linked to the FortiBleed vulnerability (CVE-2022-40684). These leaks are frequently weaponized by threat actors to gain initial access to corporate networks. The appearance of these credentials on a public leak site indicates a significant security failure.
Recommendations: Immediately rotate all SSL-VPN credentials and enforce multi-factor authentication (MFA).; Update FortiOS to the latest stable version to remediate CVE-2022-40684.; Perform a comprehensive audit of VPN access logs for unauthorized activity.
Source: Ransomware.live
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-08-03 05:13 UTC
Ransomware attack and data leak Unauthorized access to corporate networks and compromise of employee credentials The LockBit ransomware group leveraged exposed credentials stemming from the ‘FortiBleed’ leak (CVE-2022-40684) to gain access to the victim’s network. This attack demonstrates how threat actors weaponize historical vulnerability leaks to secure initial access. The breach resulted in the compromise of multiple employee accounts.
Corroborating source: ransomware.live
Update — 2026-08-07 07:27 UTC
Leak of SSL-VPN credentials resulting from a known Fortinet vulnerability. Increased risk of unauthorized network entry and potential ransomware deployment. Attackers leveraged the FortiBleed vulnerability (CVE-2022-40684) to harvest FortiOS SSL-VPN credentials. This leak provides a viable path for initial access, which is frequently the first step in a broader ransomware campaign. The exposure of these credentials allows threat actors to bypass perimeter security using legitimate accounts.
Corroborating source: ransomware.live
Update — 2026-08-08 16:31 UTC
Ransomware attack and credential leak. Exposure of over 160 user accounts and potential data exfiltration. The threat actor leveraged exposed FortiOS SSL-VPN credentials linked to the ‘FortiBleed’ vulnerability (CVE-2022-40684) for initial access. This allowed for the compromise of 161 user accounts and the potential exfiltration of sensitive data. The attack underscores the critical need for timely patching of edge devices.
Corroborating source: ransomware.live
Update — 2026-08-26 15:35 UTC
Ransomware attack and credential leak. Exposure of employee credentials and potential data exfiltration. The victim, neooftalmo.com.br, was compromised using credentials exposed via the FortiBleed vulnerability (CVE-2022-40684). This incident illustrates how threat actors leverage leaked SSL-VPN credentials to establish initial access for ransomware operations.
Corroborating source: ransomware.live
Update — 2026-09-30 03:42 UTC
Leak of FortiOS SSL-VPN credentials via the FortiBleed vulnerability. Potential unauthorized network access and increased risk of a ransomware deployment. The victim’s FortiOS SSL-VPN credentials were leaked via CVE-2022-40684, known as FortiBleed. This exposure provides a direct entry point for threat actors to gain internal network access. The listing on a ransomware tracking platform indicates that these credentials are being monitored or utilized by extortionists.
Corroborating source: ransomware.live
Update — 2026-10-30 16:48 UTC
Leak of SSL-VPN credentials via the FortiBleed vulnerability. Potential unauthorized access to internal network resources and corporate data. Threat actors leveraged the FortiBleed vulnerability (CVE-2022-40684) to exfiltrate SSL-VPN credentials from the victim. This exposure provides a direct entry point for unauthorized access into the corporate environment. The leak specifically identifies compromised third-party employee credentials, increasing the risk of supply chain pivoting.
Corroborating source: ransomware.live