Critical FortiGate Flaw Exploited to Deploy PivotC2 RAT and Steal Credentials

Threat actors are actively exploiting CVE-2025-25249, a critical heap-based buffer overflow in FortiOS and FortiSwitchManager’s cw_acd daemon, to compromise exposed FortiGate firewalls and deploy the PivotC2 remote access trojan (RAT).

SOCRadar Threat Research Unit (STRU) assessed with high confidence that exploitation began no later than July 2026 and remains active.

The campaign reportedly targeted more than 30,000 FortiGate IP addresses and resulted in 178 confirmed PivotC2 infections, with the United States accounting for the largest concentration of affected systems.

Critical FortiGate Flaw

CVE-2025-25249 carries a CVSS v3 score of 9.8 and enables unauthenticated remote code execution through specially crafted CAPWAP traffic sent to UDP port 5246. Fortinet appliances use CAPWAP to centrally manage wireless access points.

The vulnerable cw_acd process is present in affected FortiOS releases, including versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.0 through 7.0.17, and all FortiOS 6.4 versions. FortiSwitchManager versions 7.2.0 through 7.2.6 and 7.0.0 through 7.0.5 are also affected.

Attackers use a self-extracting Linux exploit binary, fortirun.bin, with Bash and Python automation scripts.

The tool fingerprints a target’s firmware and hardware configuration, abuses CAPWAP discovery responses to defeat ASLR protections, grooms the daemon heap, and corrupts linked-list pointers to gain an arbitrary-write primitive.

It then hijacks execution flow to launch a Node.js reverse shell. The initial JavaScript stager downloads and decrypts a second-stage payload, saving PivotC2 as /tmp/.i.js before launching it in the background.

The malware maintains an outbound TLS connection to its command-and-control infrastructure, bypassing inbound firewall restrictions.

PivotC2 is tailored specifically for FortiGate post-exploitation. Its capabilities include interactive shell access, command execution, file upload and download, CIDR-range port scanning, SOCKS5 and HTTP proxying, and local or remote port forwarding.

Its binary framing protocol multiplexes multiple SSH-like channels over one TLS session, enabling operators to tunnel into internal networks through a compromised perimeter appliance.

Most concerningly, the RAT can harvest FortiGate configuration files and decrypt stored credentials. Targeted files include global configurations, VDOM configuration archives, and fsv_sync.dat, which contains device-specific cryptographic material.

Socradar stated that decrypted data may expose administrator credentials, SSL-VPN accounts, LDAP bind credentials, wireless pre-shared keys, and IPsec VPN secrets.

PivotC2 includes an --auto mode that automatically harvests configuration data, extracts credentials, identifies internal interfaces, and scans discovered subnets for services including SSH, LDAP, SMB, RDP, Microsoft SQL Server, and PostgreSQL.

Researchers also identified evidence of two full intrusions against US organizations. The actors reportedly used Active Directory enumeration, browser credential theft, reverse SSH relays, RDP configuration changes, and S3-based exfiltration tooling.

Russian-language comments and financially motivated tradecraft suggest a Russian-speaking cybercrime operator.

Organizations should upgrade FortiOS to 7.6.4, 7.4.9, 7.2.12, or 7.0.18 and FortiSwitchManager to 7.2.7 or 7.0.6, or later.

Administrators should also restrict CAPWAP exposure on external interfaces, inspect systems for /tmp/.i.js and suspicious Node.js processes, and investigate outbound sessions to known C2 infrastructure.

Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC

The post Critical FortiGate Flaw Exploited to Deploy PivotC2 RAT and Steal Credentials appeared first on Cyber Security News.