Back Ransomware.Live

🏴‍☠️ Nightspire has just published a new victim : DiamondLease

Ransomware.Live • September 11, 2026

Share: View original

This domain's FortiOS SSL-VPN credentials were exposed via the "FortiBleed" leak ( CVE-2022-40684 ).

The following DNS records were found for the victim's domain.

binoy.kaladi diamondlease.com

diamondlease-com.mail.protection.outlook.com. Microsoft 365

v=spf1 ip4:185.56.88.169 ip4:185.56.88.168 include:mlrcloud.com include:spf.protection.outlook.com -all

Vp1zSAnzdpobVCLVJd12g+sJxN5z+jbxaFs2yY5RhRQ=

C2R5xXuoCHyIutX1mzsfa4OcY+DI4lsprJMluw6FtWA=

google-site-verification=oh1q2JiLRImqB5oPLZi2aUKvFkQUtkFbTrO47FCxIKE

google-site-verification=OZuk_DVeKoe7enjqU8lck63Q0n4xBfaMN1AaevGoKB0

selector1-diamondlease-com._domainkey.diamondleasellc.onmicrosoft.com

selector2-diamondlease-com._domainkey.diamondleasellc.onmicrosoft.com

Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content . The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Nightspire Targets DiamondLease and Tuboaços da Amazônia with FortiBleed Exploits On September 11, 2026, ransomware group Nightspire announced two new victims: DiamondLease and Tuboaços da Amazônia Ltda. Both companies had their FortiOS SSL-VPN credentials exposed due to the FortiBleed vulnerability (CVE-2022-40684). This vulnerability was published on October 18, 2022, and was added to the CISA KEV list for active exploitation on October 11, 2022. The DNS records for both victims were publicly indexed, revealing their use of Microsoft 365 services. The attack highlights the ongoing threat posed by ransomware groups exploiting known vulnerabilities. The current status indicates that both companies are dealing with the aftermath of the breach. No specific details on the extent of the data compromised have been disclosed yet. 2 sources 55

Extracted Entities

🏴‍☠️ Nightspire has just published a new victim : DiamondLease

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (1)

CVEs (1)

Domains (5)

IP Addresses (2)

Platforms (2)