Although your system may be patched to this vulnerability, if it was not immediately patched at the time of the original publication, it is possible ForitGate SSL-VPN credentials were extracted. It is unclear when the credentials were obtained, it is only known that they were obtained when a system was scanned and exploited prior to receiving the required patch in defence of CVE-2018-13379. A patch was released for this vulnerability in November 2019, however, if the account passwords have not been reset, the disclosed accounts remain vulnerable. This exploit allows an unauthenticated attacker to download FortiOS system files through a specifically crafted HTTP resource request. The credential leak was achieved by exploiting a path traversal vulnerability in the FortiOS SSL VPN, CVE-2018-13379/FG-IR-18-384. The full list of compromised Fortigate SSL-VPN devices, extracted from the RAMP hacking form can be found here. The leak appears to be intended to promote the RAMP hacking forum and the Groove ransomware-as-a-service operation in an attempt to recruit possible ransomware operators. The threat actor is thought to be ‘Orange’, the administrator for the newly launched RAMP hacking forum, alleged representative of the new Groove ransomware operation and a previous operator for the Babuk Ransomware operation. The attack vector was identified as a system unpatched against CVE-2018-13379. Yesterday, it was announced that Fortinet discovered a breach, resulting in the disclosure of almost 500,000 FortiGate SSL-VPN credentials from 87,000 FortiGate SSL-VPN Devices. Fortinet FortiGate SSL-VPN advisory Breaches, Alerts & Advisories

Fortigate ssl vpn