Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware
An active exploitation campaign targeting FortiGate firewalls, in which attackers weaponize a critical vulnerability to plant a custom-built Node.js remote access trojan (RAT) that turns compromised perimeter devices into long-term footholds for espionage and data theft. The SOCRadar Threat Research Unit (STRU) has identified, with high confidence, that threat actors are actively exploiting CVE-2025-25249, a.
- Report priority
- High
How it works
An active exploitation campaign targeting FortiGate firewalls, in which attackers weaponize a critical vulnerability to plant a custom-built Node.js remote access trojan (RAT) that turns compromised perimeter devices into long-term footholds for espionage and data theft.
What to do
Do not open the file, link, or package described in the report. If it ran, isolate the device and investigate the indicators named there.
Technical details
A critical heap-based buffer overflow in the cw_acd daemon (part of FortiOS and FortiSwitchManager) allows unauthenticated attackers to execute arbitrary code by sending malformed UDP requests to the CAPWAP Control service (port 5246). Tracked as CVE-2025-25249 (CVSS 9.8), this flaw affects FortiOS versions 6.4 through 7.6.3 and FortiSwitchManager 7.0.x and 7.2.x. Disclosed on January 13, 2026, Fortinet released patches shortly after.
Attackers are exploiting this vulnerability in the wild to deploy fortirun.bin, a custom Node.js-based RAT. The malware establishes a reverse shell, downloads a second-stage payload (PivotC2) via JavaScript, and persists as a background process. PivotC2 enables long-term access by bypassing firewalls through outbound TLS connections.
The tool's development appears AI-assisted, with version 0.2.3 still under active refinement.