Fortinet FortiGate Critical Vulnerability Exploited for Node.js Malware

Key Takeaways

• A critical heap-based buffer overflow vulnerability in Fortinet FortiGate firewalls, tracked as CVE-2025-25249, is being actively exploited.
• The flaw allows unauthenticated remote code execution, rated 9.8 on the CVSSv3 scale.
• Attackers are deploying a sophisticated custom Node.js remote access trojan (RAT) named PivotC2, specifically designed for FortiGate devices.
• The malware enables extensive espionage, data theft, and lateral movement, potentially compromising entire internal networks.
• Fortinet released patches on January 13, 2026; immediate upgrades and mitigation steps are crucial for affected organizations.

Cybersecurity researchers have uncovered an active exploitation campaign targeting Fortinet FortiGate firewalls, leveraging a critical vulnerability to implant a purpose-built Node.js remote access trojan (RAT). This sophisticated malware transforms compromised perimeter devices into persistent footholds for espionage and data exfiltration.

Critical Vulnerability Enables Remote Code Execution

The SOCRadar Threat Research Unit (STRU) has confirmed that threat actors are actively exploiting CVE-2025-25249. This critical heap-based buffer overflow flaw resides within the cw_acd daemon of FortiOS and FortiSwitchManager. The vulnerability carries a CVSSv3 score of 9.8, indicating its severe impact.

Exploitation allows unauthenticated remote attackers to execute arbitrary code by sending specially crafted requests to the CAPWAP Control service, which operates on UDP port 5246. Fortinet utilizes CAPWAP for centralized management of wireless access points, making this daemon accessible on numerous internet-facing FortiGate appliances. Affected versions include FortiOS 6.4 through 7.6.3 and FortiSwitchManager 7.0.x and 7.2.x. Fortinet released patches for these vulnerabilities following disclosure on January 13, 2026.

Custom Node.js Malware: PivotC2

Instead of relying on readily available exploit kits, the attackers employ a custom binary, fortirun.bin, orchestrated through Bash and Python scripts. These scripts automate the exploitation attempts against target IP addresses until successful. Once the buffer overflow is triggered, the exploit establishes a reverse shell and executes a single-line JavaScript stager via Node.js.

This initial stager retrieves a second-stage payload from an attacker-controlled server. It then decodes the payload from Base64, decrypts it using XOR encryption, and writes the resulting file to a temporary location. This file is executed as a detached background process, ensuring its persistence even after the initial connection is terminated.

The second-stage payload is PivotC2, a bespoke Node.js post-exploitation framework specifically tailored for FortiGate appliances, as extensively detailed in the report published by SOCRadar. STRU researchers noted that the malware’s detailed inline comments and structured usage guidance strongly suggest the developers utilized AI coding assistance. The recovered version (0.2.3) indicates that PivotC2 is still under active development.

PivotC2 Capabilities and Impact

PivotC2 functions as a lightweight, SSH-inspired remote access tool. It initiates outbound TLS connections to its command-and-control (C2) server, effectively bypassing inbound firewall restrictions. All communication occurs through a single encrypted socket, utilizing a binary framing protocol that multiplexes multiple channels. These channels support interactive shells, file transfers, SOCKS5 and HTTP proxy tunneling, and both local and remote port forwarding.

Beyond generic remote access, PivotC2 incorporates FortiGate-specific functionalities. It can harvest device configuration files, extract network interface data, and automatically decrypt encrypted (ENC) credential fields using AES-256-CBC and AES-128-GCM routines. This capability yields plaintext VPN pre-shared keys, SSL-VPN credentials, wireless network passwords, and administrator accounts, providing attackers with a direct route into the broader internal network.

A particularly notable feature is its “auto-mode.” When activated, every newly infected device automatically triggers a five-stage pipeline without operator intervention. This pipeline harvests configurations, decrypts credentials, extracts internal subnets, and launches background port scans across common service ports, facilitating mass, hands-off compromise at scale.

Campaign Scope and Attribution

STRU’s analysis revealed that the operators scanned over 30,000 FortiGate IP addresses, successfully compromising 178 devices with PivotC2. The United States reported the highest concentration of infections, followed by Chile, Colombia, and the United Kingdom. Investigators confirmed two full network intrusions against U.S.-based organizations, which involved lateral movement, browser credential theft, RDP configuration abuse, and the exfiltration of Microsoft Exchange mailbox data to Wasabi cloud storage buckets.

Based on observed tradecraft, including Russian-language code comments, significant use of AI-assisted tooling, and financially motivated exfiltration patterns targeting backup and storage infrastructure, STRU assesses with high confidence that a Russian-speaking, financially driven cybercrime operator is behind this campaign. The group also appears to be exploiting other known vulnerabilities, including flaws in FortiManager, PeopleSoft Enterprise PeopleTools, and ArubaOS.

What You Should Do

• Patch Immediately: Upgrade FortiOS to versions 7.6.4, 7.4.9, 7.2.12, or 7.0.18 and above. Upgrade FortiSwitchManager to 7.2.7 or 7.0.6 and above.
• Restrict CAPWAP Exposure: Limit external exposure to CAPWAP Control ports (UDP 5246) wherever possible.
• Hunt for Suspicious Activity: Actively search for suspicious Node.js processes and artifacts, such as /tmp/.i.js, on exposed appliances.
• Monitor Network Connections: Check active sessions for connections to known malicious IP addresses.
• Rotate Credentials: If signs of compromise are detected, immediately treat all locally stored credentials, including SSL-VPN, LDAP, and IPSec keys, as exposed and rotate them without delay.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.