Skip to content
Krybit and Qilin Target Organizations with FortiBleed Exploits

Krybit and Qilin Target Organizations with FortiBleed Exploits

First seen 24 Oct 2026, 11:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 24, 2026 at 12:43 UTC

Cybercriminal groups Krybit and Qilin have recently published details of their attacks on organizations using FortiOS SSL-VPN, exploiting the FortiBleed vulnerability (CVE-2022-40684). Krybit's latest victim is www.zhservices.com, while Qilin has targeted Revi Group. Both incidents involve the exposure of FortiOS SSL-VPN credentials due to the vulnerability, which has been since its addition to the CISA KEV catalog in October 2022. The vulnerability has a CVSS score of 9.8, indicating a threat level. Organizations using affected FortiOS versions are urged to take immediate action to mitigate risks. Current reports indicate that these attacks are ongoing, with multiple victims potentially affected.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2022-10-09
First public PoC for CVE-2022-40684
Proof-of-concept code for the vulnerability was released publicly, raising awareness of its exploitation potential.
Ransomware.Live
2022-10-11
CVE-2022-40684 added to CISA KEV
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog due to active exploitation.
Ransomware.Live
2026-10-23
Qilin publishes Revi Group victim
Qilin announced Revi Group as a victim, revealing the exposure of FortiOS SSL-VPN credentials.
Ransomware.Live
2026-10-24
Krybit publishes www.zhservices.com victim
Krybit disclosed www.zhservices.com as a victim, also linked to the FortiBleed vulnerability.
Ransomware.Live

More articles in this cluster (3)

Following this threat?

Track Revi Group and CVE-2022-40684 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 3

Common questions

What systems are affected by CVE-2022-40684?
FortiOS SSL-VPN systems are affected, particularly versions that have not been patched.
How can organizations protect themselves?
Organizations should apply the latest patches for FortiOS and consider disabling SSL-VPN access until fully updated.
Are there any known victims?
Yes, Krybit and Qilin have publicly disclosed attacks on www.zhservices.com and Revi Group, respectively.