[threat-actors] Add Belsen Group

clusters/threat-actor.json

@@ -17678,6 +17678,17 @@
       },
       "uuid": "dda55447-f7bc-405a-ab2e-c9be9fc1c53f",
       "value": "Operation DRBControl"
+    },
+    {
+      "description": "The Belsen Group has exploited the CVE-2022-40684 vulnerability in Fortinet devices to compromise over 15,000 FortiGate firewalls, releasing detailed configurations and plaintext VPN credentials. Their leaked data, organized by country and IP address, primarily consists of configurations from FortiOS 7.0.6 and 7.2.1, which were the last vulnerable versions before patches were issued. Security researcher Kevin Beaumont confirmed that the group leveraged this vulnerability to gain unauthorized access and warned of potential exploitation of CVE-2024-55591 by similar threat actors. Fortinet has stated that the leaked data originates from older campaigns and not from any recent incidents.",
+      "meta": {
+        "refs": [
+          "https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-data-posting",
+          "https://socradar.io/fortigate-firewall-configs-cve-2022-40684-exploitation/"
+        ]
+      },
+      "uuid": "3ef31ccd-60a9-4abc-a1a3-713ce625cbb7",
+      "value": "Belsen Group"
     }
   ],
   "version": 322