FortiGate CVE-2025-25249 Exploited to Deploy PivotC2 RAT — Patch Now

FortiGate Firewalls Under Active Attack: Inside the PivotC2 Node.js RAT Campaign

Quick Answer: Attackers are exploiting CVE-2025-25249, a critical FortiOS/FortiSwitchManager flaw, to plant PivotC2, a custom Node.js RAT. Patch to FortiOS 7.6.4+ immediately and hunt for compromise indicators.

Last verified: September 13, 2026

Picture a SOC analyst on a Tuesday morning, scrolling through overnight alerts, when a single line jumps out: an outbound TLS connection from the organization's edge firewall to an IP address nobody recognizes. Not from a server. Not from a workstation. From the firewall itself. That's the scenario now playing out across enterprise networks worldwide, and it's exactly the kind of blind spot that makes perimeter devices such an attractive target — they're trusted by design, rarely monitored like endpoints, and often sit outside standard EDR coverage.

According to research published by SOCRadar's Threat Research Unit (STRU), a financially motivated threat actor has been quietly weaponizing a patched FortiGate vulnerability since at least July 2026, turning firewalls into long-term footholds using a custom-built remote access trojan called PivotC2. If your organization runs FortiGate appliances for enterprise vulnerability management or perimeter defense, this is one advisory worth reading end to end.

Table of Contents

• What Happened: CVE-2025-25249 Explained
• The Attack Chain: From Buffer Overflow to Backdoor
• Inside PivotC2: What Makes This RAT Different
• Victimology and Threat Actor Attribution
• Indicators of Compromise and Detection Tips
• Detection and Prevention: What SOC Teams Should Do Now
• Expert Tips
• FAQ

What Happened: CVE-2025-25249 Explained

CVE-2025-25249 is a heap-based buffer overflow in the cw_acd daemon, the process FortiOS and FortiSwitchManager use to run CAPWAP (Control and Provisioning of Wireless Access Points), the protocol Fortinet devices use to centrally manage wireless access points. Per Fortinet's own advisory (FG-IR-25-084), the flaw can let a remote, unauthenticated attacker execute arbitrary code or commands by sending specially crafted requests to the CAPWAP Control service on UDP port 5246.

Fortinet issued patches on January 13, 2026 for FortiOS 6.4 through 7.6.3 and FortiSwitchManager 7.0.x/7.2.x. Note: published CVSS scoring for this flaw varies slightly across sources — SOCRadar and NVD list it around 7.3–7.4, while some secondary write-ups cite 9.8. Either way, it's classified high-to-critical severity, and that gap between "patched in January" and "actively exploited by September" is exactly why this campaign matters: it's a textbook case of attackers weaponizing a known, patched CVE against organizations that simply haven't updated yet.

The Attack Chain: From Buffer Overflow to Backdoor

STRU's analysis describes a deliberately engineered, repeatable process rather than an off-the-shelf exploit kit:

1. Attackers run a custom binary (tracked as fortirun.bin), orchestrated by Bash and Python automation, that repeatedly attempts exploitation against target IP ranges.
2. Once the buffer overflow triggers successfully, the exploit opens a reverse shell on the compromised appliance.
3. A single-line JavaScript stager executes via Node.js — notable because Node.js isn't something defenders typically expect to see running on a firewall appliance.
4. The stager fetches a second-stage payload from an attacker-controlled server, decodes it from Base64, decrypts it with XOR, and writes it to a temporary file.
5. That file runs as a detached background process, meaning it survives even after the original connection closes — this is the persistence mechanism.

The second stage is PivotC2 itself — and researchers note its inline code comments and structured usage guidance strongly suggest the developers used AI coding assistants to build it. The recovered sample (version 0.2.3) indicates active, ongoing development rather than a finished, static tool.

Inside PivotC2: What Makes This RAT Different

Most commodity RATs are generic. PivotC2 is purpose-built for one platform, and that specialization is what makes it dangerous.

Architecturally, it behaves like a lightweight, SSH-inspired remote access tool. Rather than waiting for inbound connections — which firewall rules typically block — it initiates outbound TLS connections to its command-and-control server, sidestepping perimeter defenses entirely. All communication flows through a single encrypted socket using a binary framing protocol that multiplexes several channels at once: interactive shells, file transfer, SOCKS5/HTTP proxy tunneling, and both local and remote port forwarding.

What elevates it beyond a generic backdoor is its FortiGate-specific tooling. PivotC2 can harvest device configuration files, extract network interface and internal subnet data, and automatically decrypt encrypted (ENC) credential fields using AES-256-CBC and AES-128-GCM routines — recovering plaintext VPN pre-shared keys, SSL-VPN credentials, wireless passwords, and admin accounts in the process.

Perhaps the most concerning feature is "auto-mode." When enabled, every newly infected device automatically runs a five-stage pipeline — harvest configs, decrypt credentials, extract internal subnets, and launch background port scans — with zero operator involvement. That's mass, hands-off compromise built for scale, not a manual, targeted intrusion.

Victimology and Threat Actor Attribution

STRU reports the campaign scanned more than 30,000 internet-facing FortiGate IP addresses and successfully compromised 178 devices. The United States recorded the highest concentration of infections, followed by Chile, Colombia, and the United Kingdom.

Investigators confirmed two full network intrusions against US-based organizations, involving lateral movement, browser credential theft, RDP configuration abuse, and exfiltration of Microsoft Exchange mailbox data to Wasabi cloud storage buckets.

Based on observed tradecraft — Russian-language code comments, heavy reliance on AI-assisted tooling, and exfiltration patterns focused on backup and storage infrastructure rather than sabotage — SOCRadar assesses with high confidence that a Russian-speaking, financially motivated cybercrime operator is behind the activity. It's worth stressing this is an analytical assessment based on available evidence, not a confirmed, named-actor attribution. The same group also appears to be probing other known flaws in FortiManager, PeopleSoft Enterprise PeopleTools, and ArubaOS, suggesting a broader opportunistic campaign against edge infrastructure generally.

Indicators of Compromise and Detection Tips

If you manage FortiGate appliances, these are the artifacts and behaviors worth hunting for right now:

• Unexpected Node.js processes running on the firewall itself — Node.js has no legitimate reason to be active on a FortiGate appliance.
• The file path /tmp/.i.js on exposed appliances, a known artifact from this campaign.
• Outbound TLS sessions from the firewall to unfamiliar or newly-seen external IPs — since PivotC2 relies entirely on outbound C2, this is often the most visible signal in NetFlow or firewall session logs.
• Unusual, sustained background processes that persist independent of active admin sessions.

A simple triage command administrators can run from the FortiGate CLI to check for a known artifact:

execute shell ls /tmp/.i.js

If this file exists, treat the device as compromised and move directly into incident response — this command only checks for a known indicator; it does not remediate anything by itself.

Detection and Prevention: What SOC Teams Should Do Now

Given how this campaign specifically targets edge devices, defense has to start at the patch layer and extend into ongoing SOC threat detection workflows, not stop at a single fix.

• Patch immediately. Upgrade to FortiOS 7.6.4, 7.4.9, 7.2.12, or 7.0.18 and above, and FortiSwitchManager 7.2.7 or 7.0.6 and above. This is the single highest-impact action available.
• Restrict CAPWAP exposure. Limit or firewall off external access to the CAPWAP Control service (UDP 5246) wherever it isn't strictly required for legitimate wireless AP management.
• Hunt, don't just patch. Because exploitation has reportedly been active since July 2026, patching alone doesn't rule out prior compromise — check for the IOCs above before assuming you're clean.
• Rotate credentials proactively. Because PivotC2 harvests device configurations wholesale, any organization that finds signs of compromise should treat all locally stored credentials — SSL-VPN, LDAP, IPSec keys — as exposed and rotate them without delay.
• Monitor outbound firewall traffic, not just inbound. This campaign's entire persistence model depends on outbound connections evading typical perimeter monitoring — pairing firewall logs with an endpoint detection and response or network detection layer that flags anomalous outbound sessions from network infrastructure itself closes a real visibility gap.
• Review compliance exposure. Organizations subject to frameworks like NIST 800-53 or, in regulated sectors, HIPAA, should treat unpatched internet-facing CVEs in the Known Exploited Vulnerabilities catalog as a documented risk-acceptance decision, not an oversight — this isn't legal advice, but it is a defensible audit posture.

No single control here guarantees full protection — layered detection combined with prompt patching materially reduces the exposure window, which is really the best any organization can aim for against a moving, actively-developed threat like this.

Expert Tips

• Treat perimeter appliances — firewalls, VPN concentrators, wireless controllers — as monitored assets in your SIEM, not just managed infrastructure. This campaign is only visible if someone is watching the firewall's own outbound behavior.
• Build a standing playbook for "patched-but-actively-exploited" CVEs specifically. The gap between patch release and confirmed active exploitation (January to July/September 2026 here) is often where organizations get burned.
• When a vendor tool starts running an unexpected runtime (Node.js on a firewall, PowerShell on a printer, etc.), treat that alone as a detection-worthy anomaly, independent of any known malware family.

Related Cybersecurity Topics You Should Explore

• Critical Dell SCG Bug (CVSS 9.8) Grants Root Access — Patch Now
  
• WeWorm: Zero-Click WeChat Worm Hijacks 1.4B Accounts via Call
  
• US Offers $10 Million for Iranian Hacker Behind Critical Infrastructure Attacks
  
• Panzer Ransomware Targets Italian Manufacturers With ESXi-Ready Malware
  
• BigBear 2.0 Evilginx2 Phishing Bypasses Microsoft 365 MFA With Session Cookie Theft
  
• Veradigm Data Breach: How a Stolen Vendor Login Exposed Patient SSNs
  
• Hackers Hide Windows Backdoor Inside HiveMQ and Element Chat
  
• Plex Emailed Users Over Hidden Security Flaws — Update Now
  
• TP-Link Archer AX55 Flaws Let Hackers Steal Admin Access

FAQ

Is CVE-2025-25249 a zero-day?
No. It was disclosed and patched by Fortinet in January 2026. This campaign is an example of attackers exploiting a known, already-patched vulnerability against organizations that haven't applied the fix.

What is PivotC2?
A custom-built Node.js remote access trojan designed specifically for post-exploitation on FortiGate appliances, offering interactive shell access, tunneling, credential harvesting, and automated ("auto-mode") mass compromise capability.

How do I know if my FortiGate has been compromised?
Check for the file /tmp/.i.js, look for unexpected Node.js processes, and review outbound TLS sessions from the appliance to unfamiliar IPs. Confirmed indicators warrant full incident response, not just a patch.

Which FortiOS versions are affected?
FortiOS 6.4 through 7.6.3 and FortiSwitchManager 7.0.x/7.2.x are affected. Patched versions are FortiOS 7.6.4, 7.4.9, 7.2.12, 7.0.18 and above, and FortiSwitchManager 7.2.7 or 7.0.6 and above.

Who is behind this campaign?
SOCRadar assesses with high confidence, based on code artifacts and exfiltration patterns, that a Russian-speaking, financially motivated cybercrime group is responsible. This is an analytical assessment, not a confirmed named-actor attribution.

Does patching alone fix a compromised device?
No. Patching closes the vulnerability going forward, but if a device was already compromised, credentials and configuration data may already be in attacker hands. Rotate all locally stored credentials as a precaution.

A Final Word

Edge devices keep proving they're the softest part of the perimeter — not because they're poorly built, but because they sit in a monitoring blind spot most organizations haven't closed yet. PivotC2 is a reminder that "patched" doesn't mean "safe" if the patch never got applied. If you're running FortiGate in production, this is worth an hour of your team's time today, not next sprint.

Found this useful? Share it with your SOC team, and subscribe for the next breakdown as this campaign develops.

Analysis based on SOC monitoring and public threat intelligence review.