Nightspire Targets DiamondLease and Tuboaços da Amazônia with FortiBleed Exploits

• •Nightspire has targeted two companies, DiamondLease and Tuboaços da Amazônia, using the FortiBleed vulnerability.
• •Both companies' FortiOS SSL-VPN credentials were exposed, indicating a significant security breach.
• •CVE-2022-40684 has been actively exploited since its addition to the CISA KEV list in October 2022.

On September 11, 2026, ransomware group Nightspire announced two new victims: DiamondLease and Tuboaços da Amazônia Ltda. Both companies had their FortiOS SSL-VPN credentials exposed due to the FortiBleed vulnerability (CVE-2022-40684). This vulnerability was published on October 18, 2022, and was added to the CISA KEV list for active exploitation on October 11, 2022. The DNS records for both victims were publicly indexed, revealing their use of Microsoft 365 services. The attack highlights the ongoing threat posed by ransomware groups exploiting known vulnerabilities. The current status indicates that both companies are dealing with the aftermath of the breach. No specific details on the extent of the data compromised have been disclosed yet.