Belsen Group
- First seen
- 2022-09-01 00:00:00
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- organization
- Actor type
- criminal, nation-state
- Profile updated
- 2026-07-07 12:19:58
Targeted industries: technology-and-telecommunications government-and-public-sector
Context
The Belsen Group has exploited the CVE-2022-40684 vulnerability in Fortinet devices to compromise over 15,000 FortiGate firewalls, releasing detailed configurations and plaintext VPN credentials. Their leaked data, organized by country and IP address, primarily consists of configurations from FortiOS 7.0.6 and 7.2.1, which were the last vulnerable versions before patches were issued. Security researcher Kevin Beaumont confirmed that the group leveraged this vulnerability to gain unauthorized access and warned of potential exploitation of CVE-2024-55591 by similar threat actors. Fortinet has stated that the leaked data originates from older campaigns and not from any recent incidents.
Exploited vulnerabilities
- CVE-2022-40684 (vulnerability)
- CVE-2024-55591 (vulnerability)
Reports & references
- fortinet.com — Analysis Of Threat Actor Data Posting (report)
- socradar.io — Fortigate Firewall Configs Cve 2022 40684 Exploitation (report)