MalwareExploits 1 CVE

PivotC2

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2025-25249Unauthenticated RCE in FortiOS and FortiSwitchManager cw_acdExploited in the wild

Threat actors are actively exploiting CVE-2025-25249, a critical heap-based buffer overflow flaw affecting the cw_acd daemon in FortiOS and FortiSwitchManager. The flaw permits remote, unauthenticated arbitrary code execution through specially crafted requests to the CAPWAP Control service on UDP port 5246. | That second stage is PivotC2, a purpose-built Node.js post-exploitation framework designed specifically for FortiGate appliances.

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence2

Threat actors actively exploited CVE-2025-25249 in the internet-reachable CAPWAP Control service on UDP port 5246 to achieve remote unauthenticated arbitrary code execution.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

Attackers deploy fortirun.bin “orchestrated through Bash and Python automation scripts that repeatedly attempt exploitation against target IPs until successful.”

T1059.004Unix ShellEvidence2

“Once the buffer overflow triggers, the exploit opens a reverse shell and executes a single-line JavaScript stager via Node.js.”

T1059.007JavaScriptEvidence1

The exploit opens a reverse shell and executes a single-line JavaScript stager via Node.js.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence2

The stager “decodes it from Base64, decrypts it using XOR encryption, and writes the result to a temporary file.”

T1140Deobfuscate/Decode Files or InformationEvidence1

This stager quietly fetches a second-stage payload ... decodes it from Base64, decrypts it using XOR encryption.

Credential Access

1 technique

T1552.001Credentials In FilesEvidence2

PivotC2 “harvest[s] device configuration files” and decrypts FortiGate ENC fields, yielding “plaintext VPN pre-shared keys, SSL-VPN credentials, wireless network passwords, and administrator accounts.”

Discovery

2 techniques

T1016System Network Configuration DiscoveryEvidence1

PivotC2 can “extract network interface data,” and auto-mode “extracts internal subnets.”

T1046Network Service DiscoveryEvidence2

Auto-mode “launches background port scans across common service ports without operator involvement.”

Lateral Movement

1 technique

T1021.001Remote Desktop ProtocolEvidence1

Investigators confirmed two full network intrusions against U.S.-based organizations, involving lateral movement ... [and] RDP configuration abuse.

Collection

1 technique

T1602.002Network Device Configuration DumpEvidence1

PivotC2 includes FortiGate-specific functionality: it can harvest device configuration files ... This yields plaintext VPN pre-shared keys, SSL-VPN credentials, wireless network passwords, and administrator accounts.

Command and Control

5 techniques

T1090ProxyEvidence2

PivotC2 supports “SOCKS5 and HTTP proxy tunneling.”

T1095Non-Application Layer ProtocolEvidence1

All traffic flows through a single encrypted socket using a binary framing protocol that multiplexes multiple communication channels.

T1105Ingress Tool TransferEvidence2

The Node.js stager “fetches a second-stage payload from an attacker-controlled server.”

T1572Protocol TunnelingEvidence2

PivotC2 supports “both local and remote port forwarding” over a single encrypted socket.

T1573Encrypted ChannelEvidence2

“It initiates outbound TLS connections to its command-and-control server” and traffic flows through “a single encrypted socket.”

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cryptika blogNews

Sep 8, 2026

Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware | Cryptika Cybersecurity

A Node.js remote-access and post-exploitation framework for compromised FortiGate devices. It establishes outbound TLS C2 connections and supports interactive shells, file transfer, SOCKS5/HTTP tunneling, and local/remote port forwarding. It also harvests FortiGate configurations, decrypts stored credential fields, identifies internal subnets, and can automatically scan internal services.

cyber security newsNews

Sep 8, 2026

Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware

A custom Node.js remote-access and post-exploitation framework for compromised FortiGate devices. It establishes outbound TLS C2 over a multiplexed binary protocol; provides interactive shells, file transfer, SOCKS5/HTTP proxying, and local/remote port forwarding; and harvests FortiGate configurations, network data, and decrypted credentials. Its automated mode performs configuration and credential collection, internal-subnet discovery, and port scanning.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

PivotC2

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2025-25249Unauthenticated RCE in FortiOS and FortiSwitchManager cw_acdExploited in the wild

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence2

Threat actors actively exploited CVE-2025-25249 in the internet-reachable CAPWAP Control service on UDP port 5246 to achieve remote unauthenticated arbitrary code execution.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

Attackers deploy fortirun.bin “orchestrated through Bash and Python automation scripts that repeatedly attempt exploitation against target IPs until successful.”

T1059.004Unix ShellEvidence2

“Once the buffer overflow triggers, the exploit opens a reverse shell and executes a single-line JavaScript stager via Node.js.”

T1059.007JavaScriptEvidence1

The exploit opens a reverse shell and executes a single-line JavaScript stager via Node.js.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence2

The stager “decodes it from Base64, decrypts it using XOR encryption, and writes the result to a temporary file.”

T1140Deobfuscate/Decode Files or InformationEvidence1

This stager quietly fetches a second-stage payload ... decodes it from Base64, decrypts it using XOR encryption.

Credential Access

1 technique

T1552.001Credentials In FilesEvidence2

Discovery

2 techniques

T1016System Network Configuration DiscoveryEvidence1

PivotC2 can “extract network interface data,” and auto-mode “extracts internal subnets.”

T1046Network Service DiscoveryEvidence2

Auto-mode “launches background port scans across common service ports without operator involvement.”

Lateral Movement

1 technique

T1021.001Remote Desktop ProtocolEvidence1

Investigators confirmed two full network intrusions against U.S.-based organizations, involving lateral movement ... [and] RDP configuration abuse.

Collection

1 technique

T1602.002Network Device Configuration DumpEvidence1

Command and Control

5 techniques

T1090ProxyEvidence2

PivotC2 supports “SOCKS5 and HTTP proxy tunneling.”

T1095Non-Application Layer ProtocolEvidence1

All traffic flows through a single encrypted socket using a binary framing protocol that multiplexes multiple communication channels.

T1105Ingress Tool TransferEvidence2

The Node.js stager “fetches a second-stage payload from an attacker-controlled server.”

T1572Protocol TunnelingEvidence2

PivotC2 supports “both local and remote port forwarding” over a single encrypted socket.

T1573Encrypted ChannelEvidence2

“It initiates outbound TLS connections to its command-and-control server” and traffic flows through “a single encrypted socket.”

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cryptika blogNews

Sep 8, 2026

Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware | Cryptika Cybersecurity

cyber security newsNews

Sep 8, 2026

Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.