FortiGate Firewalls Targeted by Custom Node.js Malware via Active Exploitation of CVE-2025-25249
Attackers are actively exploiting a critical heap-based buffer overflow in FortiOS (CVE-2025-25249) to deploy a custom Node.js RAT named PivotC2, compromising over 178 devices.
Threat actors are actively exploiting CVE-2025-25249, a critical heap-based buffer overflow vulnerability in FortiOS and FortiSwitchManager, to deploy a custom-built Node.js remote access trojan (RAT) dubbed PivotC2. This vulnerability, rated 9.8 on the CVSSv3 scale, allows remote, unauthenticated attackers to execute arbitrary code by sending specially crafted requests to the CAPWAP Control service, which is often exposed on internet-facing FortiGate appliances.
The exploit chain begins with attackers sending malicious requests to the CAPWAP daemon, triggering the buffer overflow. This opens a reverse shell and executes a single-line JavaScript stager via Node.js. This stager then fetches a second-stage payload from an attacker-controlled server, decodes it from Base64, decrypts it using XOR encryption, and writes it to a temporary file. This file runs as a detached background process, ensuring persistence even after the initial connection is closed.
The second-stage payload is PivotC2, a purpose-built Node.js post-exploitation framework specifically designed for FortiGate appliances. Researchers noted that the malware's inline comments and usage guidance suggest the use of AI coding assistance, with the recovered version (0.2.3) indicating ongoing development. PivotC2 operates as a lightweight, SSH-inspired remote access tool, initiating outbound TLS connections to its command-and-control (C2) server to bypass inbound firewall restrictions.
All communication occurs over a single encrypted socket using a binary framing protocol that supports multiple communication channels. These include interactive shells, file uploads and downloads, SOCKS5 and HTTP proxy tunneling, and both local and remote port forwarding. PivotC2 also includes FortiGate-specific functionalities, such as harvesting device configurations, extracting network interface data, and automatically decrypting encrypted credential fields using AES-256-CBC and AES-128-GCM decryption routines.
This credential harvesting capability is particularly dangerous, as it yields plaintext VPN pre-shared keys, SSL-VPN credentials, wireless network passwords, and administrator accounts, providing attackers with a direct pathway into the internal network. The malware's "auto-mode" feature further enhances its threat, automatically initiating a five-stage pipeline on new infections to harvest configurations, decrypt credentials, extract internal subnets, and launch port scans across common service ports without operator intervention.
SOCRadar's analysis revealed that the operators scanned over 30,000 FortiGate IP addresses and successfully compromised 178 devices with PivotC2. The United States experienced the highest concentration of infections, followed by Chile, Colombia, and the United Kingdom. Two full network intrusions against U.S. organizations were confirmed, involving lateral movement, credential theft, RDP abuse, and exfiltration of Microsoft Exchange mailbox data.
Based on observed tradecraft, including Russian-language code comments and financially motivated exfiltration patterns, researchers assess with high confidence that a Russian-speaking, financially driven cybercrime operator is behind this campaign. The group is also suspected of exploiting other vulnerabilities in FortiManager, PeopleSoft Enterprise PeopleTools, and ArubaOS.
Fortinet has issued patches for affected versions, including FortiOS 6.4 through 7.6.3 and FortiSwitchManager 7.0.x and 7.2.x. Organizations are urged to upgrade to patched versions such as FortiOS 7.6.4, 7.4.9, 7.2.12, or 7.0.18 and above, and FortiSwitchManager 7.2.7 or 7.0.6 and above. Administrators should also restrict external exposure to CAPWAP Control ports, hunt for suspicious Node.js processes and artifacts, and check active sessions for malicious connections. Any detected compromise should prompt immediate rotation of all locally stored credentials.