An ongoing cyberattack campaign is exploiting vulnerabilities in FortiGate firewalls to install a bespoke Node.js remote access trojan (RAT). This malicious software transforms compromised devices into persistent espionage and data theft tools.
Exploitation of CVE-2025-25249 Vulnerability
The SOCRadar Threat Research Unit (STRU) has identified that hackers are actively exploiting a critical vulnerability, labeled CVE-2025-25249. This flaw, a heap-based buffer overflow in the cw_acd daemon of FortiOS and FortiSwitchManager, allows attackers to execute arbitrary code.
With a severity rating of 9.8 on the CVSSv3 scale, the flaw enables remote, unauthenticated code execution via crafted requests sent to the CAPWAP Control service on UDP port 5246. CAPWAP, used by Fortinet to manage wireless access points, makes the vulnerability accessible across numerous internet-facing FortiGate devices. The affected software versions include FortiOS 6.4 through 7.6.3 and FortiSwitchManager 7.0.x and 7.2.x, although patches were released in January 2026.
Deployment and Functionality of PivotC2 Malware
Attackers utilize a custom binary, fortirun.bin, deployed using automation scripts in Bash and Python to repeatedly exploit targeted IPs. Upon triggering the buffer overflow, the exploit initiates a reverse shell and executes a JavaScript stager via Node.js.
This stager retrieves a secondary payload from a hacker-controlled server, decoding it from Base64 and decrypting it with XOR encryption, before running it in the background. The second-stage malware, known as PivotC2, is a specialized Node.js framework tailored for FortiGate appliances.
PivotC2 establishes outbound TLS connections to its command-and-control server, bypassing inbound firewall restrictions. It supports multiple functions such as interactive shells, file transfers, and network proxy tunneling. Additionally, it can decrypt sensitive data, including VPN keys and admin credentials, using AES-256-CBC and AES-128-GCM algorithms.
Impact and Response Measures
The malware’s automated features enable large-scale network compromises, with over 30,000 FortiGate IP addresses scanned and 178 devices compromised. The U.S. has the highest infection rate, with Chile, Colombia, and the UK also affected.
In confirmed attacks against U.S. organizations, hackers achieved complete network intrusions, stealing credentials and exfiltrating data to cloud storage. STRU attributes these actions to a Russian-speaking cybercrime group, based on language and tool usage patterns.
Organizations using Fortinet products should upgrade to the latest patched versions and restrict CAPWAP port access. It’s crucial to monitor for suspicious Node.js activity and connections to known malicious IPs. Compromised credentials should be rotated immediately to prevent further unauthorized access.
For those wanting to bolster their security infrastructure, exploring AI-driven Security Operations Center (SOC) deployment strategies is recommended. Download the free AI SOC Deployment Playbook 2026 for more insights.
