- Newly established Belsen Group leaks a 1.6 GB archive
- It contains IP addresses, passwords and more, allegedly from FortiGate devices
- The data was retrieved two years ago using a zero day
Sensitive information on more than 15,000 FortiGate units has been leaked online after a new threat actor calling itself the “Belsen Group” posted the archive on a dark web forum in an attempt to promote their operations and make a name for themselves.
The group says the data includes IP addresses, passwords and configurations, and to make analysis easier, it categorized the targets by country names.
“At the beginning of the year, and as a positive start for us, and to strengthen the name of our group in your memory, we are proud to announce our first official operation,” reads the thread on the forum.
Authentic, but old, data
As part of its data leak efforts, the group set up a dedicated Tor site as the archive is 1.6 GB in size.
“Will be releasing sensitive data from over 15,000 targets worldwide (both government and private sectors) that have been hacked and their data extracted,” it noted.
“And the biggest surprise: All this sensitive and crucial data is absolutely free, offered to you as a gift from the Belsen Group.”
Several security analysts confirmed that the data breach is indeed two years old, but was never released to the public.
The data was obtained by exploiting CVE-2022-40684 while it was still a zero-day bug. It affected FortiOS 7.0.0-7.0.6 and 7.2.0-7.2.2.
“I have performed incident response on one device at a victim organization and the exploit was actually via CVE-2022-40684 based on artifacts on the device,” said one of the researchers, Kevin Beaumont, in a blog post. “I’ve also been able to confirm that the usernames and passwords seen in the dump match the details on the device.”
“The data appears to have been collected in October 2022, as a zero-day vuln. For some reason, the data dump of the config has been released today, well over 2 years later.”
Via Bleeping Computer
