An active exploitation campaign targeting FortiGate firewalls, in which attackers weaponize a critical vulnerability to plant a custom-built Node.js remote access trojan (RAT) that turns compromised perimeter devices into long-term footholds for espionage and data theft.
The SOCRadar Threat Research Unit (STRU) has identified, with high confidence, that threat actors are actively exploiting CVE-2025-25249, a critical heap-based buffer overflow flaw affecting the cw_acd daemon in FortiOS and FortiSwitchManager.
Rated 9.8 on the CVSSv3 scale, the vulnerability allows remote, unauthenticated attackers to execute arbitrary code by sending specially crafted requests to the CAPWAP Control service, which listens on UDP port 5246.
Fortinet uses CAPWAP to manage wireless access points centrally, making the daemon reachable on many internet-facing FortiGate appliances. Affected versions span FortiOS 6.4 through 7.6.3 and FortiSwitchManager 7.0.x and 7.2.x, though Fortinet issued patches following disclosure on January 13, 2026.
FortiGate Firewalls Hacked to Deploy Malware
Rather than relying on off-the-shelf exploit kits, the attackers deploy a custom binary called fortirun.bin, orchestrated through Bash and Python automation scripts that repeatedly attempt exploitation against target IPs until successful.
Once the buffer overflow triggers, the exploit opens a reverse shell and executes a single-line JavaScript stager via Node.js.
This stager quietly fetches a second-stage payload from an attacker-controlled server, decodes it from Base64, decrypts it using XOR encryption, and writes the result to a temporary file that runs as a detached background process surviving even after the initial connection closes.
That second stage is PivotC2, a purpose-built Node.js post-exploitation framework designed specifically for FortiGate appliances, as detailed in the report published by SOCRadar.
STRU researchers note that the malware’s detailed inline comments and structured usage guidance strongly suggest its developers used AI coding assistance, and the recovered version (0.2.3) indicates the tool is still in active development.
PivotC2 behaves like a lightweight, SSH-inspired remote access tool. It initiates outbound TLS connections to its command-and-control server, sidestepping inbound firewall restrictions entirely.
All traffic flows through a single encrypted socket using a binary framing protocol that multiplexes multiple communication channels supporting interactive shells, file uploads and downloads, SOCKS5 and HTTP proxy tunneling, and both local and remote port forwarding.
Beyond generic remote access, PivotC2 includes FortiGate-specific functionality: it can harvest device configuration files, extract network interface data, and automatically decrypt encrypted (ENC) credential fields using AES-256-CBC and AES-128-GCM decryption routines.
This yields plaintext VPN pre-shared keys, SSL-VPN credentials, wireless network passwords, and administrator accounts, giving attackers a direct path into the broader internal network.
Perhaps most notable is its “auto-mode” feature. When enabled, every new infected device automatically triggers a five-stage pipeline that harvests configurations, decrypts credentials, extracts internal subnets, and launches background port scans across common service ports without operator involvement, enabling mass, hands-off compromise at scale.
STRU’s analysis found the operators scanned more than 30,000 FortiGate IP addresses and successfully compromised 178 devices with PivotC2. The United States recorded the highest concentration of infections, followed by Chile, Colombia, and the United Kingdom.
Investigators confirmed two full network intrusions against U.S.-based organizations, involving lateral movement, browser credential theft, RDP configuration abuse, and exfiltration of Microsoft Exchange mailbox data to Wasabi cloud storage buckets.
Based on observed tradecraft, including Russian-language code comments, heavy use of AI-assisted tooling, and financially motivated exfiltration patterns focused on backup and storage infrastructure, STRU assesses with high confidence that a Russian-speaking, financially driven cybercrime operator is behind the campaign.
The group also appears to be exploiting other known vulnerabilities, including flaws in FortiManager, PeopleSoft Enterprise PeopleTools, and ArubaOS.
Organizations running Fortinet products should upgrade immediately to patched versions FortiOS 7.6.4, 7.4.9, 7.2.12, or 7.0.18 and above, and FortiSwitchManager 7.2.7 or 7.0.6 and above.
Administrators should also restrict external exposure to CAPWAP Control ports, hunt for suspicious Node.js processes and artifacts such as /tmp/.i.js on exposed appliances, and check active sessions for connections to known malicious IP addresses.
Because PivotC2 harvests device configurations wholesale, any organization that detects signs of compromise should treat all locally stored credentials, including SSL-VPN, LDAP, and IPSec keys, as exposed and rotate them without delay.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware appeared first on Cyber Security News.