Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT

Threat actors are actively exploiting a critical vulnerability in FortiGate to deploy PivotC2, a Node. js-based remote access trojan (RAT) designed for persistent post-exploitation of FortiOS appliances.

Researchers at SOCRadar’s Threat Research Unit (STRU) reported that this campaign has targeted over 30,000 internet-exposed FortiGate IP addresses and has successfully compromised at least 178 devices since July 2026.

The exploitation targets CVE-2025-25249, a critical heap-based buffer overflow found in the cw_acd daemon used by FortiOS and FortiSwitchManager.

This vulnerability has a CVSS score of 9.8, allowing unauthenticated remote attackers to execute arbitrary code through specially crafted CAPWAP requests sent to UDP port 5246.

Critical FortiGate Flaw

According to SOCRadar’s research, attackers utilize an exploit binary named fortirun.bin, supported by Bash and Python automation scripts, to repeatedly target vulnerable devices. Once successfully exploited, a reverse shell is created, and a Base64-encoded JavaScript stager is executed through Node.js.

The initial stager downloads a second-stage payload from hxxps://146[.]103[.]99[.]177:8443/0c5b76709523, decodes it, and XOR-decrypts it using the key “pivot.” The resulting JavaScript implant is then written to /tmp/.i.js and launched as a background process, enabling it to persist even if the parent Node.js process is terminated.

PivotC2 is specifically tailored for compromised FortiGate firewalls. It establishes an outbound TLS connection to attacker-controlled infrastructure and uses a compact binary protocol that multiplexes multiple SSH-like channels over a single connection.

The RAT allows operators to gain interactive shells, execute commands, upload and download files, perform SOCKS5 and HTTP proxying, enable local and remote port forwarding, conduct DNS lookups, discover processes, and scan networks based on CIDR. Its tunneling capabilities can repurpose an edge firewall as a pivot point to access otherwise isolated internal networks.

One particularly concerning feature is its automated configuration-harvesting functionality. PivotC2 can collect FortiGate configuration files, including global settings, network interface data, virtual domain configurations, and the device-specific fsv_sync.dat secret file.

The malware’s tooling can reportedly decrypt stored FortiGate credentials, revealing VPN pre-shared keys, SSL-VPN credentials, wireless passwords, LDAP bind secrets, and administrator accounts.

Researchers also identified an –auto mode that automatically executes credential collection, network extraction, and scanning of discovered internal subnets when an infected FortiGate connects to the C2 server.

Comments and operational guidance in the recovered code suggest developers may have used AI tools to speed up the RAT’s development and intrusion workflows.

STRU has assessed with high confidence that this operation is linked to a Russian-speaking, financially motivated cybercrime group.

Investigators found Russian-language comments, evidence of Active Directory enumeration, browser credential theft, RDP enablement, reverse SSH relays, Tor-based proxying, and exfiltration of Microsoft Exchange .pst mailbox files to attacker-controlled Wasabi S3 storage.

Two U.S.-based organizations have confirmed they suffered full-network intrusions and data theft. The United States has reported the highest number of PivotC2 infections, followed by Chile, Colombia, and the United Kingdom.

Organizations should immediately upgrade affected systems to FortiOS 7.6.4, 7.4.9, 7.2.12, or 7.0.18, or later releases. FortiSwitchManager users should update to versions 7.2.7 or 7.0.6 and later.

Defenders should restrict CAPWAP exposure by disabling the fabric service on internet-facing interfaces or blocking inbound UDP traffic on ports 5246-5249 with local-in policies. Incident responders should search for outbound sessions to 146.103.99.177 and 46.151.29.58, inspect the /tmp/ directory for .i.js files, and review running Node.js processes.

If you find any PivotC2 artifacts, assume FortiGate configuration data has been compromised and rotate all associated credentials, including those for the appliance, VPN, LDAP, wireless, and IPSec.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.