A live campaign is exploiting a critical Fortinet vulnerability to turn perimeter appliances into durable access points for espionage and theft. Researchers say the attackers deploy a custom Node.js framework called PivotC2, which can extract FortiGate configuration data, decrypt stored secrets and tunnel traffic into internal networks.

The activity targets CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon used by FortiOS and FortiSwitchManager. The flaw carries a CVSS score of 9.8 and can enable unauthenticated remote code execution through specially crafted traffic sent to the CAPWAP Control service on UDP port 5246. Fortinet released fixes in January 2026, but unpatched, exposed systems remain attractive targets.

From vulnerable firewall to persistent access

According to SOCRadar’s threat research team, the operators use Bash and Python automation to keep attempting exploitation against target addresses. A successful attempt opens a reverse shell and launches a compact JavaScript stager through Node.js. The stager retrieves an encoded second-stage payload, decrypts it and executes it as a detached background process.

That payload is PivotC2, a purpose-built remote-access tool tailored to FortiGate environments. It creates an outbound encrypted connection to command infrastructure, a design that can evade restrictions on unsolicited inbound traffic. A custom binary protocol carries several channels over one socket, giving the operator interactive shells, file transfer, SOCKS5 and HTTP proxying, and local or remote port forwarding.

The appliance-specific capabilities make the framework particularly dangerous. PivotC2 can collect configuration files and network-interface details, then process encrypted credential fields. Researchers report that it supports routines used to recover VPN pre-shared keys, SSL-VPN credentials, wireless passwords and administrative accounts. Those secrets can transform a firewall compromise into access across the wider organization.

Automation enables compromise at scale

An “auto-mode” feature reduces the need for hands-on operation. When a new device checks in, PivotC2 can automatically harvest its configuration, decrypt credentials, identify internal subnets and start background scans for common services. This pipeline gives attackers a rapid picture of the environment and possible routes for lateral movement.

SOCRadar observed scanning against more than 30,000 FortiGate addresses and identified 178 compromised devices. The largest number was in the United States, followed by Chile, Colombia and the United Kingdom. Investigators also documented two broader intrusions at US organizations where attackers moved laterally, stole browser credentials, altered Remote Desktop settings and exfiltrated Exchange mailbox information to cloud storage.

The researchers assess that a financially motivated, Russian-speaking operator is responsible, citing language found in code and the campaign’s behavior. They also saw indications that the group targets weaknesses in FortiManager, PeopleSoft Enterprise PeopleTools and ArubaOS. Attribution based on technical clues is not definitive, but the observed theft and infrastructure targeting are consistent with financially driven operations.

How defenders should respond

Fortinet customers should upgrade to fixed releases: FortiOS 7.6.4, 7.4.9, 7.2.12 or 7.0.18 and later, and FortiSwitchManager 7.2.7 or 7.0.6 and later. Administrators should also minimize external exposure of CAPWAP Control and confirm whether UDP port 5246 is reachable from networks that do not require it.

• Hunt for unexpected Node.js processes and temporary artifacts such as /tmp/.i.js.
• Review outbound sessions from appliances for unfamiliar encrypted connections.
• Inspect configuration changes, administrative activity and internal port scans.
• Search endpoints for follow-on browser credential theft and unusual RDP changes.
• Rotate SSL-VPN, LDAP, IPsec, wireless and administrator secrets if compromise is suspected.

Patching closes the initial entry point, but it does not remove access already established with stolen credentials. Any organization that finds PivotC2 indicators should treat the event as a network-wide incident, preserve evidence and investigate downstream systems before restoring trust. Security teams should also compare appliance activity with identity, endpoint and email telemetry to reconstruct the full intrusion timeline and locate persistence outside the firewall.