Do Son 
PivotC2 Architecture | Image: The SOCRadar Threat Research Unit
At a Glance
Russian-speaking cybercriminals targeted over 30,000 IP addresses to deploy the PivotC2 FortiGate RAT onto vulnerable network appliances. The SOCRadar Threat Research Unit identified this active campaign in September 2026. Attackers are abusing a heap-based buffer overflow vulnerability to hijack edge devices.
- Malware family: PivotC2 (Node.js Remote Access Trojan)
- Threat actor: Suspected Russian-speaking cybercrime operator
- Target or victims: 178 confirmed compromised devices, primarily in the United States
- Delivery vector: CVE-2025-25249 exploitation via the CAPWAP control daemon
- Key capabilities: Interactive shells, credential decryption, network scanning, and proxy tunneling
- Source: SOCRadar Threat Research Unit
TL;DR
Attackers exploit a critical vulnerability in Fortinet edge devices to deploy a custom payload. This malware allows criminals to harvest credentials and map internal networks. Security teams must patch exposed firewalls immediately to prevent data theft and lateral movement.
Delivery Through Vulnerable Services
The delivery mechanism relies on CVE-2025-25249 exploitation. This flaw is a critical heap-based buffer overflow in the FortiOS wireless controller service. Fortinet uses this control and provisioning daemon to manage wireless access points centrally. The service listens for incoming control traffic on a specific UDP port.
Unauthenticated attackers send crafted requests to the appliance. These malicious packets cause memory corruption within the service. This action grants the attacker arbitrary code execution privileges. Vulnerable versions include multiple releases across FortiOS and FortiSwitchManager product lines.
Operators use automated scripts to attempt this exploit multiple times. They aim to ensure a successful compromise against target IP addresses. The exploit targets devices exposed directly to the public internet.
The Infection Chain
Once the exploit succeeds, the attack chain begins automatically. The exploit binary opens a reverse shell on the compromised firewall. It executes a single-line JavaScript command using the native Node.js environment.
This initial script connects to an external server. The server delivers the next-stage payload in encoded data chunks. The script decodes and decrypts this data using a specific key. It then saves the decrypted output to a temporary system path.
The script runs this file as a background process. This background execution ensures the implant survives if the parent process terminates. This final payload is the PivotC2 FortiGate RAT. The malware binary contains embedded configuration parameters. These include target command server addresses, heartbeat intervals, and jitter settings.
Command-and-Control Behavior
The malware initiates outbound connections to external command servers. This reverse-shell architecture bypasses standard inbound firewall restrictions. The implant uses a custom binary protocol over a single encrypted socket. This protocol multiplexes different communication channels simultaneously.
The malware supports interactive command execution and file transfers. It also handles local and remote port forwarding. The command server can instruct the client to connect to internal network destinations. This feature routes traffic transparently through the compromised firewall.
The code contains detailed comments and usage guidance. Analysts believe the authors used artificial intelligence tools to write the software. The server manages session states and monitors connection health. If a client fails to send a heartbeat ping, the server terminates the session.
The command framework includes an autonomous operation mode. According to researchers, “When enabled, every new client connection automatically triggers configuration harvesting, credential decryption, network extraction, and port scanning.” The malware extracts system configurations and device-specific secret keys. It uses these keys to decrypt stored administrator passwords and virtual private network credentials.
The malware scans predefined internal IP ranges for open ports. It targets common ports used for remote access and databases. This automation allows operators to map internal networks quickly.
Data Exfiltration and Lateral Movement
The operators use stolen credentials to move laterally inside the network. During two full intrusions in the United States, attackers deployed additional tools. They used a network scanner for subnet discovery. They also modified registry keys to enable remote desktop access.
The criminals actively searched for storage and backup infrastructure. They use tools to enumerate directory services and dump computer accounts. This reconnaissance helps them identify high-value targets inside the perimeter.
The attackers extracted browser credentials from internal hosts. They impersonated tokens to decrypt stored secrets. Finally, the threat actors packaged internal email archives. They uploaded these mailbox files to external cloud storage buckets.
Analysts observed Russian language comments in the code. The attackers also deployed network traffic obfuscation tools and reverse-SSH relays. These tactics point to a financially motivated cybercrime group.
Defense and Detection Guidance
Administrators must apply firmware updates immediately. Fortinet released patches addressing this buffer overflow flaw. Upgrade affected operating systems to the latest secure versions. If immediate patching is impossible, restrict network access to the wireless provisioning daemon. Create firewall policies that drop untrusted inbound traffic to the affected UDP port.
Security teams should hunt for unauthorized Node.js processes running on edge devices. Look for unexpected background scripts in temporary directories. Monitor outbound network traffic for persistent connections to unknown IP addresses.
Treat any confirmed infection as a total credential compromise. Organizations must rotate all administrator passwords and pre-shared keys. Defenders should review internal authentication logs for lateral movement originating from the firewall. Finally, restrict outbound internet access from management network segments to prevent data exfiltration.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
