A new cyberattack campaign is actively targeting FortiGate firewalls by exploiting a critical vulnerability to install a custom Node.js-based remote access trojan (RAT). The flaw, known as CVE-2025-25249, is a heap-based buffer overflow in FortiOS and FortiSwitchManager’s cw_acd daemon. This issue, ranked 9.8 on the CVSSv3 scale, lets unauthenticated attackers send malicious requests to the CAPWAP Control service (UDP port 5246) and execute arbitrary code.
The vulnerable versions include FortiOS from 6.4 through 7.6.3, and FortiSwitchManager 7.0.x and 7.2.x. Patches were released by Fortinet on January 13, 2026, but many deployments remain unprotected. Attackers are using a custom binary dubbed fortirun.bin, along with Bash and Python scripts, to probe for vulnerable devices until one succumbs.
How the Attack Unfolds
After exploiting the buffer overflow, adversaries drop a reverse shell, run a one-line JavaScript stager through Node.js, and fetch a second stage payload from a server under their control. That payload is base64 decoded, XOR decrypted, and launched as a background process that survives even after the initial connection terminates.
This second stage is called PivotC2, a Node.js–based post-exploitation framework customized for FortiGate devices. It initiates outbound TLS connections to command-and-control servers—this bypasses firewall rules that block inbound traffic. The tool includes multiplexed channels via a binary protocol, enabling interactive shells, file transfers, HTTP and SOCKS5 proxying, and port forwarding.
Capabilities & Impact
PivotC2 can extract device configurations, gather network interface details, and decrypt encrypted credential fields—such as VPN pre-shared keys, SSL-VPN credentials, wireless passwords, and admin accounts—thanks to built-in AES-256-CBC and AES-128-GCM routines. When “auto-mode” is activated, new infections trigger five automated phases: config harvesting, credential decryption, subnet enumeration, internal port scanning, and further compromise, all without direct operator control.
The threat is global. Researchers found over 30,000 FortiGate IPs were scanned, with 178 confirmed infections. The United States is the hardest hit, followed by Chile, Colombia, and the UK. Full internal network breaches were seen in U.S. organizations, involving lateral movement, browser credential theft, abusing remote desktop protocol settings, and exfiltration of Exchange mailboxes to cloud storage.
Attribution & Other Threats
Analysis points to a financially motivated, Russian-speaking cybercrime group. Clues include Russian coding comments, AI‐assisted code generation, and focus on monetizable targets like backups and storage. The campaign isn’t limited to this vulnerability—other flaws affecting FortiManager, PeopleSoft Enterprise PeopleTools, and ArubaOS are also being exploited.
Defensive Measures
Organizations using Fortinet gear should immediately upgrade to the patched versions: FortiOS 7.6.4, 7.4.9, 7.2.12, or 7.0.18 and above; FortiSwitchManager 7.2.7 or 7.0.6 and above. They should also block exposure of CAPWAP Control ports externally, hunt for suspicious Node.js processes (especially files like /tmp/.i.js), and check for active sessions connecting to known malicious IPs.
If a system has been compromised, assume all local credentials—SSL-VPN, LDAP, IPSec keys included—have been exposed and rotate them immediately. Configuration files should be treated as breached assets once indicators of compromise appear.
This developing campaign underscores a rising trend: attackers combining zero-day or critical vulnerabilities with custom post-exploitation tools to establish long-term footholds. With automated tools like PivotC2, even small misconfigurations can lead to deep breaches. Watch for whether Fortinet’s patches are broadly adopted, and whether defenders develop detection rules to flag artifacts like Node.js stagers or high volumes of outbound TLS traffic over unusual channels.
