Approximately 500,000 Fortinet VPN account names and passwords were leaked for free by a threat-actor who goes by the name ‘Orange’, due to the exploitation of an older (already patched) vulnerability; tracked as CVE-2018-13379. It is alleged that ‘Orange’ is a former Babuk ransomware group member and is the administrator for a new hacking forum called RAMP. It is currently believed that ‘Orange’ is a member of the Groove ransomware gang. On September 7th, ‘Orange’ created a post on the RAMP hacking forum where they shared an unsecured link to a file that contained thousands of Fortinet VPN credentials. Interestingly, on the same day, the Groove ransomware group posted the same exact link on their leak/extortion site, hosted on a Tor storage server, and this makes it even more apparent that ‘Orange’ is in fact a member of Groove. Bleeping Computer analyzed the file, which contained 498,908 users’ credentials for over 12,856 individual devices and verified that all of the IP addresses belonged to registered Fortinet VPN servers. Advanced Intel CTO Vitali Kremez told BleepingComputer, “We believe with high confidence the VPN SSL leak was likely accomplished to promote the new RAMP ransomware forum offering a ‘freebie’ for wannabe ransomware operators.” It is also believed that the leak was also an advertisement for the Groove ransomware-as-a-service operation. Exactly how many of these credentials are currently valid is still heavily disputed by researchers, and CTAPT will continue to monitor this matter and provide relevant updates as more facts are confirmed.