What should Fortinet VPN server admins do? However, by offering freebies to the cybercriminal community, they may be hoping to recruit other threat actors to their affiliate system. Groove is a relatively new ransomware operation that only has one victim currently listed on their data leak site. 'We believe with high confidence the VPN SSL leak was likely accomplished to promote the new RAMP ransomware forum offering a 'freebie' for wannabe ransomware operators.' Advanced Intel CTO Vitali Kremez told BleepingComputer.

It is unclear why the threat actor released the credentials rather than using them for themselves, but it is believed to have been done to promote the RAMP hacking forum and the Groove ransomware-as-a-service operation. However some sources are giving mixed answers, with some saying many credentials work, while others state that most do not. Kremez told BleepingComputer that the now-patched Fortinet CVE-2018-13379 vulnerability was exploited to gather these credentials.Ī source in the cybersecurity industry told BleepingComputer that they were able to legally verify that at least some of the leaked credentials were valid. Geographic distribution of leaked Fortinet servers Yesterday, the threat actor created a post on the RAMP forum with a link to a file that allegedly contains thousands of Fortinet VPN accounts.

The list of Fortinet credentials was leaked for free by a threat actor known as 'Orange,' who is the administrator of the newly launched RAMP hacking forum and a previous operator of the Babuk Ransomware operation.Īfter disputes occurred between members of the Babuk gang, Orange split off to start RAMP and is now believed to be a representative of the new Groove ransomware operation. Fortinet credentials leaked on a hacking forum This leak is a serious incident as the VPN credentials could allow threat actors to access a network to perform data exfiltration, install malware, and perform ransomware attacks. While the threat actor states that the exploited Fortinet vulnerability has since been patched, they claim that many VPN credentials are still valid. A threat actor has leaked a list of almost 500,000 Fortinet VPN login names and passwords that were allegedly scraped from exploitable devices last summer.

Fortinet vpn client log