Loading story…
Dutch intelligence agencies MIVD and AIVD identified a previously undisclosed remote-access trojan during an incident-response engagement that targeted FortiGate firewall appliances. The persistence-focused malware maintained covert access to compromised devices while seeking to evade conventional security controls; attackers gained initial access by exploiting CVE-2022-42475, a critical FortiOS SSL-VPN vulnerability.
The discovery underscores continued targeting of internet-facing edge infrastructure—including firewalls, VPN gateways, and email servers—where compromise can provide privileged access to internal networks. Organizations should promptly patch affected FortiGate systems, replace unsupported equipment, restrict and protect management interfaces, minimize internet exposure, and centralize device logging to improve detection and investigation capabilities.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
The Dutch NCSC assessed CVE-2022-42475, a FortiGate vulnerability, as having high likelihood and high impact.
MIVD and AIVD identified a previously unknown remote-access trojan during an incident-response investigation. The targeted malware was designed to persist on FortiGate devices after attackers gained access, potentially through CVE-2022-42475 exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
mandiant.com
Open sourcencsc.nl
Open sourcencsc.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers have been actively targeting internet-exposed **Fortinet FortiGate** management interfaces to seize administrative control of firewalls, with reporting tying the activity to exploitation of **`CVE-2024-55591`** and a related authentication weakness, **`CVE-2025-24472`**. Fortinet said the primary flaw affects **FortiOS** and **FortiProxy** and stems from improper authentication in the Node.js websocket module, allowing an unauthenticated remote attacker to obtain **super-admin** access and full control of vulnerable devices. Observed intrusions included the creation of new administrator accounts, adding those accounts to **SSL VPN** groups, changing firewall policies, and using the compromised appliances to pivot into networks that were otherwise protected behind the VPN perimeter. Security guidance accompanying the disclosures urged organizations to apply Fortinet patches immediately, disable or restrict public exposure of management interfaces, harden FortiOS devices, and review logs for signs of compromise tied to the broader campaign against exposed firewall consoles.
Jul 24, 2026
Attackers are actively exploiting `CVE-2025-25249`, a critical unauthenticated heap-based buffer overflow in the `cw_acd` daemon of FortiOS and FortiSwitchManager, against internet-facing FortiGate appliances. The campaign deploys `fortirun.bin` and a staged Node.js payload that installs **PivotC2**, a custom remote-access framework supporting encrypted command-and-control, tunneling, file transfer, and port forwarding. PivotC2 steals FortiGate configurations and decrypts stored credentials, including VPN keys and administrative credentials, while also conducting subnet discovery and port scanning. SOCRadar reported scans of more than 30,000 FortiGate IP addresses and compromise of 178 devices, with the largest infection concentration in the United States. Two confirmed U.S. intrusions involved lateral movement, browser-credential theft, RDP configuration abuse, and Microsoft Exchange mailbox-data exfiltration. The operators are assessed as likely Russian-speaking, financially motivated cybercriminals; organizations should apply Fortinet’s patched releases, limit external CAPWAP exposure, investigate Node.js artifacts and suspicious sessions, and rotate credentials after suspected compromise.
Sep 14, 2026
Fortinet reported limited active exploitation of **CVE-2024-21762**, a critical out-of-bounds write vulnerability in the `sslvpnd` component of FortiOS SSL-VPN. An unauthenticated remote attacker can trigger denial of service or execute arbitrary code, potentially taking control of a vulnerable FortiGate appliance. The vulnerability is rated CVSS 9.6, and public proof-of-concept exploit code became available. Organizations running affected FortiOS 7.4 and earlier releases should apply Fortinet’s security updates immediately; FortiOS 7.6 is not affected. The Dutch National Cyber Security Centre assessed the issue as High/High due to its impact, active exploitation, and expected exploit availability, and advised disabling SSL-VPN as a temporary mitigation where immediate patching is not possible.
Sep 3, 2026