ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Threat actor

Russian-speaking cybercrime actor

1 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks

Threat actors exploit Fortinet heap-based buffer overflow CVE-2025-25249 to deploy PivotC2 RAT, infecting 178 devices and exfiltrating data from US targets.

SOCRadar reports exploitation of an unauthenticated remote code execution vulnerability, CVE-2025-25249 (CVSS 7.4), patched in January in FortiOS and FortiSwitchManager. Attackers scanned over 30,000 IP addresses, infected 178 devices with PivotC2 RAT, and at least two intrusions resulted in data exfiltration, primarily targeting US entities. SOCRadar attributes attacks to a likely Russian-speaking cybercrime actor and suggests the RAT was AI-assisted, in use since July 2026. CISA added the CVE to the KEV catalog with a three-day BOD 26-04 patch deadline for federal agencies.

SecurityWeekupdated · 5d agofirst · 5d agoExploit / PoC in the wild 4 sourcesCVE-2025-252491

Related CVEs

  • CVE-2025-252499.82%
    Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE
    CVE-2025-25249 is a heap-based buffer overflow (CWE-122/CWE-787) in Fortinet FortiOS, FortiSwitchManager, and FortiSASE that allows an attacker to execute unauthorized code or commands. It is triggered by sending specially crafted packets to an affected device, causing an out-of-bounds write in heap memory that can be leveraged for code execution. Successful exploitation gives attackers command execution on the appliance; in observed intrusions against FortiGate firewalls, attackers have deployed custom Node.js malware and a post-exploitation RAT dubbed PivotC2. Any organization running the affected Fortinet products is at risk, with internet-facing FortiGate firewalls the primary concern. The flaw was added to CISA's KEV on 2026-09-09, confirming active exploitation in the wild (ransomware use unknown); no public PoC is known.
    · Fortinet FortiOS · Fortinet FortiSwitchManager KEV PoC mass

Appears with

malware PivotC2 1organization CISA 1organization SOCRadar 1product FortiGate 1product FortiOS 1product FortiSwitchManager 1vendor Fortinet 1victim US entities 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.