1. Executive summary
The HYFLOCK ransomware group listed Ateşsan Ambalaj A.Ş., a Turkish corrugated packaging manufacturer founded in 1972, on its leak site on 2026-11-02. The listing is the operator's own claim; no source confirms the intrusion, the data taken, or the timing. A related ransomware.live page for the same victim states that the domain's FortiOS SSL-VPN credentials were exposed in the "FortiBleed" leak, which it ties to CVE-2022-40684 and to a "FortiBleed 2.0" leak dated October 2026. That credential-exposure claim is single-sourced and unverified. For EMEA financial services the direct risk is low: the victim is a packaging manufacturer, not a financial entity, and no source links it to a financial-services supply chain. The exposure matters to clients that share FortiOS SSL-VPN infrastructure or hold credentials in the same leak corpus.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
The primary item is a leak-site listing. It establishes that HYFLOCK claims Ateşsan Ambalaj as a victim, gives the country as TR and the website as atessan.com.tr, and carries a company profile: a corrugated box and packaging manufacturer founded in 1972, with annual output up to 150,000 metric tons, a 36,000-square-metre enclosed production area, two factories (the Hadımköy Central Factory near Arnavutköy in Istanbul and the Gebze Plant in Kocaeli Province), and a ranking of 231st on the Istanbul Chamber of Industry "Top 500 Industrial Companies in Turkey" list. The listing does not state an initial access vector, the data taken, the volume of data, the timing of the intrusion, or any confirmation by the victim. It gives no malware name, no encryption details and no ransom demand.
A related ransomware.live page for the same victim adds a credential-exposure claim. It states that the domain's FortiOS SSL-VPN credentials were exposed via the "FortiBleed" leak, which it associates with CVE-2022-40684, and references a "FortiBleed 2.0" leak from October 2026. The page also shows DNS records and a leak screenshot but the fetched text does not reproduce their contents. This is a single source and the claim is unverified. It does not establish that the exposed credentials were used to enter Ateşsan's network, that HYFLOCK obtained or used them, or that the leak and the ransomware listing are the same event. Treat any link between the FortiBleed exposure and the HYFLOCK claim as unconfirmed.
CVE-2022-40684 is an authentication-bypass flaw in FortiOS SSL-VPN. The related source names it as the vulnerability behind the FortiBleed leak. No CVSS score, severity rating, EPSS value or CISA KEV state for CVE-2022-40684 is recorded in the data available to this advisory, so none is asserted here; clients should confirm the current NVD and CISA KEV status directly before relying on it. The primary item does not mention CVE-2022-40684 at all; the CVE appears only on the related page.
No attack chain can be reconstructed from confirmed steps. The only sequence any source implies is: FortiOS SSL-VPN credentials for atessan.com.tr appear in the FortiBleed leak (single source, unverified), and separately HYFLOCK lists the company as a victim (operator claim). The step between them, if any, is not documented.
4. Mitigation & containment
The sources name no malware, no fixed release and no vendor patch for this event. The only technical exposure named is FortiOS SSL-VPN credential leakage tied to CVE-2022-40684. The steps below address that exposure and the general handling of a leak-site claim; they do not rest on a confirmed intrusion at Ateşsan.
P1 (within 24 hours)
- Search the FortiBleed leak corpus, including the "FortiBleed 2.0" set referenced by the related source, for your own domains and for any third-party or supplier domains you authenticate against, and force a credential reset on any FortiOS SSL-VPN account found. The leak contents are not reproduced in this advisory; obtain the corpus through your threat-intelligence provider.
- Inventory every internet-facing FortiOS SSL-VPN endpoint in your estate and confirm its firmware is at a release that closes CVE-2022-40684. No fixed version is named in the sources for this event; take the fixed release from Fortinet's own advisory for CVE-2022-40684 rather than from this note.
- Where a supplier or counterparty uses FortiOS SSL-VPN and appears in the leak, notify them through your third-party risk process and ask them to confirm credential rotation.
P2 (within 72 hours)
- Enforce multi-factor authentication on all SSL-VPN accounts and review authentication logs for logins from unexpected geographies or from infrastructure associated with the leak.
- If you hold a business relationship with Ateşsan Ambalaj, treat any inbound email, invoice change or payment-instruction update from atessan.com.tr as untrusted until the company confirms its status out of band. The listing gives no evidence of data theft, but a compromised mailbox is a common route to payment fraud and the sources do not rule it out.
P3 (within 7 days)
- Add the victim domain to monitoring for lookalike-registration and phishing infrastructure, given the operator claim is public.
- Review whether any of your own credentials appear in the FortiBleed corpus beyond SSL-VPN, and rotate where they do.
5. Indicators of compromise
No indicators of compromise available in the source material.
The only network value in the sources is the victim's own website, atessan.com.tr, which is not a malicious indicator and is therefore not listed. The related page references DNS records and a leak screenshot but the fetched text does not give their contents, so nothing pivotable can be extracted. The FortiBleed leak is named but no credential, hash, IP or domain from it is provided.
6. Detection
Insufficient indicators to author detection rules.
The sources give no malware strings, file names, command lines, registry keys, mutexes or network artefacts belonging to HYFLOCK or to this intrusion. The victim domain and the CVE identifier are not threat artefacts and would produce rules that match reporting about the event rather than the event itself.
7. Sources
- ransomware.live, "Ransomware: HYFLOCK named Ateşsan Ambalaj (TR)", https://www.ransomware.live/id/QXRlxZ9zYW4gQW1iYWxhakBIWUZMT0NL, 2026-11-02.
- ransomware.live, "Victim: Ateşsan Ambalaj – HYFLOCK", https://www.ransomware.live/id/QXRlxZ9zYW4gQW1iYWxhakBIWUZMT0NL (related page; states the FortiOS SSL-VPN / FortiBleed credential-exposure claim and references CVE-2022-40684).
8. Adverse Trace position
Adverse Trace assesses this as a low-severity item for EMEA financial services. The primary fact is an operator claim on a leak site against a Turkish packaging manufacturer; no source confirms the intrusion, the data taken or the timing, and no source links the victim to a financial-services supply chain. The FortiBleed credential-exposure claim tied to CVE-2022-40684 is single-sourced and unverified, and we do not treat it as the confirmed access vector; clients should verify it before acting. HYFLOCK has no MITRE ATT&CK profile in the data we hold, so the attribution to a tracked actor is unconfirmed and we make no assessment of the group's capability or motives. We will monitor the leak site for a data dump or victim confirmation, watch for any update to the FortiBleed corpus that names financial-sector domains, and reissue this note if either changes the picture. Clients with FortiOS SSL-VPN exposure should action the P1 credential search now rather than wait for that update.
Published via PulseTrace — Adverse Trace threat intelligence.