A critical FortiGate vulnerability (CVE-2025-25249), patched back in January 2026, is being actively exploited to deploy a custom Node.js RAT called PivotC2. 178 devices compromised so far. Here's the breakdown.
What's happening
SOCRadar's Threat Research Unit found active exploitation of CVE-2025-25249 — a heap-based buffer overflow in the cw_acd daemon that FortiOS/FortiSwitchManager use for CAPWAP (wireless AP management). Attackers send crafted requests to UDP port 5246, trigger the overflow, and drop a reverse shell — all unauthenticated.
The payload: PivotC2
From the reverse shell, a single-line JS stager pulls a Node.js-based RAT (PivotC2) that:
- Uses outbound-only TLS to C2, bypassing inbound firewall rules
- Multiplexes shells, file transfer, and SOCKS5/HTTP proxying over one socket
- Auto-decrypts stored FortiGate credentials (VPN PSKs, SSL-VPN, admin accounts) via AES-256-CBC/AES-128-GCM
- Runs a hands-off "auto-mode" pipeline: harvest → decrypt → scan, no operator input needed
Code comments suggest AI-assisted development. Version 0.2.3 — still actively maintained.
Scale and attribution
- 30,000+ FortiGate IPs scanned, 178 compromised (US highest, then Chile, Colombia, UK)
- 2 confirmed full network intrusions in the US, including Exchange mailbox exfil to Wasabi cloud storage
- Assessed (high confidence, not certain) as a Russian-speaking, financially motivated group
What to do if you run FortiGate
Run this on the FortiGate CLI to check for a known artifact: execute shell ls /tmp/.i.js
If that file exists, treat the device as compromised.
- Patch to FortiOS 7.6.4 / 7.4.9 / 7.2.12 / 7.0.18+
- Restrict external CAPWAP (UDP 5246) exposure
- Hunt for unexpected Node.js processes before trusting a patch alone
- Rotate all stored VPN/SSL-VPN credentials if compromise is suspected
Full attack chain, IOCs, and detection checklist: https://www.xpert4cyber.com/2026/09/fortigate-firewall-hack-pivotc2-malware.html
Top comments (0)