Belsen_Group and exploitation of CVE-2022-40684

Context

On January 29, 2025, a user of the cybercriminal forum Belsen_Group published a message claiming to hold 15,000 compromised Fortinet devices, with configuration files and VPN passwords. He now offers 1,000 exclusive targets for sale on the dark web.

However, our analysis of the files shows that Belsen_Group is not behind this compromise, but has simply recycled an older leak resulting from the exploitation of vulnerability CVE-2022-40684, a critical flaw allowing unauthenticated administrator access via HTTP/HTTPS.

Evidence of a previous compromise via CVE-2022-40684

Data extracted from the leak:

• 15,474 compromised Fortinet devices
• 9,088 recovered VPN password files
• 6,386 missing files (deleted or not captured)
• 41.27% of leaked configurations without VPN password file

Detailed information

========== SUMMARY ==========

Total subdirectories: 15 474
Total 'config.conf' files: 15 474
Total 'vpn-passwords.txt' files: 9 088

Total IP addresses: 15 474
Total unique IP addresses: 15 469

Total extracted email addresses: 43360 Total unique email addresses: 25601

========== AFFECTED VERSIONS ==========

Version 7.0.0 : 1 376 affected devices
Version 7.0.1 : 1 882 affected devices
Version 7.0.2 : 1 252 affected devices
Version 7.0.3 : 1 181 affected devices
Version 7.0.4 : 320 affected devices
Version 7.0.5 : 2 395 affected devices
Version 7.0.6 : 2 245 affected devices
Version 7.2.0 : 2 593 affected devices
Version 7.2.1 : 2 209 affected devices
Version 7.2.2 : 1 affected device

Unknown version: 21 affected devices (corrupted or missing files)

Vulnerable Fortinet versions:

• FortiOS 7.0.0 → 7.0.6
• FortiOS 7.2.0 → 7.2.1

Fortinet had published a patch in November 2022 (FortiOS 7.0.7 and 7.2.2), which means these leaks come from a compromise that took place before that date.

Detected Indicators of Compromise (IOCs)

Our analysis revealed two key intrusion markers, confirming a massive exploitation of CVE-2022-40684:

• user=Local_Process_Access (15,453 occurrences)

Marker confirmed by Fortinet as a sign of exploitation of CVE-2022-40684. Allows unauthenticated access to FortiGate systems via hidden administrative commands.

• fortigate-tech-support (9,335 occurrences)

Addition of a fake administrator account ("super_admin") used to maintain permanent access. This account is visible in the configuration files:

This account has been massively used in exploits related to CVE-2022-40684.

In the recovered files, a suspicious Python script was discovered at the root, named I.py.

What does this script do?

Adds the "Belsen Group" signature to the first line of passwords.txt files. Renames passwords.txt files to vpn-passwords.txt.

Why does this script prove that Belsen_Group is not behind the hack?

No data theft → The script only modifies files locally, it does not exfiltrate them. Adds a visible signature "-=-= Belsen Group -=-=" to pretend to be the origin of the compromise.

This means that Belsen_Group only recovered and reused an existing leak.

Therefore, this group has no connection to the initial compromise, it merely recycles and resells already compromised accesses.

The script used for the analysis is available in this repository, so that you can reproduce our research or improve it.

You will also find a table listing the compromised IPs, indicating:

• The number of compromised accounts
• The affected FortiOS version
• The presence or absence of detected IOCs

Protect your infrastructures! Conduct an immediate audit and apply the necessary patches.

Sources

• https://www.cve.org/CVERecord?id=CVE-2022-40684
• https://www.fortiguard.com/psirt/FG-IR-22-377