Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware

Cybersecuritynews •Guru Baran • September 8, 2026

An active exploitation campaign targeting FortiGate firewalls, in which attackers weaponize a critical vulnerability to plant a custom-built Node.js remote access trojan (RAT) that turns compromised perimeter devices into long-term footholds for espionage and data theft. The SOCRadar Threat Research Unit (STRU) has identified, with high confidence, that threat actors are actively exploiting CVE-2025-25249, a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fortinet Vulnerability CVE-2025-25249 Exploited by PivotC2 RAT Threat actors are exploiting CVE-2025-25249, a heap-based buffer overflow vulnerability in FortiOS and FortiSwitchManager, to deploy a Node.js remote access trojan (RAT) known as PivotC2. This vulnerability allows unauthenticated remote code execution, affecting numerous devices, including FortiGate appliances. Reports indicate that over 30,000 IP addresses have been targeted, resulting in the infection of at least 178 devices, primarily in the U.S. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this CVE to its Known Exploited Vulnerabilities catalog, urging immediate patching. The vulnerability was patched by Fortinet in January 2026, but active exploitation has been confirmed as of September 2026. Organizations using affected versions are advised to upgrade to the latest releases to mitigate risks. 11 sources 73

Extracted Entities

Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware

The full story

Extracted Entities

Attack Types (2)

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)