rule bulwark_https_bulwarkblack_com_fortibleed_fortinet_vpn_ransomware_incident_response
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/fortibleed-fortinet-vpn-ransomware-incident-response/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-07T01:04:41Z"
        tlp = "TLP:CLEAR"
        indicator_count = "24"
    strings:
        $s0 = "socradar.io" ascii wide nocase  // Domains
        $s1 = "www.cloudsek.com" ascii wide nocase  // Domains
        $s2 = "https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/" ascii wide nocase  // URLs
        $s3 = "https://www.cloudsek.com/blog/inside-the-fortibleed-open-directory-a-technical-analysis-of-what-the-" ascii wide nocase  // URLs
        $s4 = "103.27.186.156" ascii wide nocase  // IPv4
        $s5 = "104.28.155.27" ascii wide nocase  // IPv4
        $s6 = "154.202.59.169" ascii wide nocase  // IPv4
        $s7 = "185.136.15.43" ascii wide nocase  // IPv4
        $s8 = "185.136.15.66" ascii wide nocase  // IPv4
        $s9 = "185.199.199.56" ascii wide nocase  // IPv4
        $s10 = "193.8.186.33" ascii wide nocase  // IPv4
        $s11 = "193.8.187.2" ascii wide nocase  // IPv4
        $s12 = "193.8.187.42" ascii wide nocase  // IPv4
        $s13 = "45.154.12.132" ascii wide nocase  // IPv4
        $s14 = "45.155.250.158" ascii wide nocase  // IPv4
        $s15 = "45.227.254.210" ascii wide nocase  // IPv4
        $s16 = "66.175.220.111" ascii wide nocase  // IPv4
        $s17 = "77.91.118.10" ascii wide nocase  // IPv4
        $s18 = "80.75.212.113" ascii wide nocase  // IPv4
        $s19 = "85.11.187.8" ascii wide nocase  // IPv4
        $s20 = "87.251.64.13" ascii wide nocase  // IPv4
        $s21 = "87.251.64.16" ascii wide nocase  // IPv4
        $s22 = "87.251.64.17" ascii wide nocase  // IPv4
        $s23 = "87.251.64.44" ascii wide nocase  // IPv4
    condition:
        any of ($s*)
}