PivotC2 RAT Exploiting FortiGate CVE-2025-25249

A high-confidence assessment by SOCRadar STRU identifies a Russian-speaking, financially motivated cybercrime campaign targeting over 30,000 FortiGate IP addresses. The campaign exploits CVE-2025-25249, a critical heap-based buffer overflow in the FortiOS cw_acd daemon, to deliver a new post-exploitation framework called PivotC2. Active exploitation has been observed since at least July 2026, primarily affecting organizations in the United States, Chile, and the United Kingdom.

The attack chain involves an exploit binary (fortirun.bin) that bypasses ASLR via heap grooming to execute a Node.js-based reverse shell. Once established, the PivotC2 RAT enables autonomous post-exploitation, including configuration harvesting, automated credential decryption of FortiOS secrets, and internal network scanning. This facilitates rapid lateral movement from edge devices into the internal enterprise environment.

The use of AI-assisted development is suspected due to extensive inline code comments and usage guidance. With at least 178 confirmed infections and evidence of data exfiltration to Wasabi S3 storage, organizations are urged to patch vulnerable FortiOS instances and rotate all credentials stored on potentially compromised perimeter devices.