PivotC2 on 178 FortiGate Devices: Why Edge Appliances Are the Quietest Place to Hide

SOCRadar reported that attackers used CVE-2025-25249, a heap buffer overflow in FortiOS, FortiSwitchManager and FortiSASE, to deploy a Node.js remote access trojan called PivotC2 on 178 FortiGate devices. The campaign scanned more than 3,000 IP addresses, and most of the infections were in the United States. The actor was assessed as Russian-speaking and financially motivated.

CISA added the flaw to the Known Exploited Vulnerabilities catalog on 9 September 2026, alongside CVE-2026-20079 in Cisco Secure FMC and CVE-2026-19490 in Citrix NetScaler, with a federal remediation deadline of 12 September 2026. The CVSS score for CVE-2025-25249 is 7.3, and it allows an unauthenticated remote attacker to execute arbitrary code.

What PivotC2 does once it is installed

PivotC2 is a Node.js implant. According to the reporting, it supports an interactive shell, file transfer, SOCKS5 and HTTP proxy tunnelling, port forwarding, CIDR scanning, and harvesting and decryption of FortiGate configuration. It also has an autonomous mode that runs a predefined command sequence after the initial infection, without waiting for an operator.

The configuration harvesting matters as much as the remote access. A FortiGate configuration contains credentials, VPN secrets and the network topology the device protects. Decrypting it gives an attacker a map of the environment and the keys to move through it.

Why the appliance is a good hiding place

Edge devices have three properties that make them attractive. They sit on the trust boundary, so traffic through them is expected. They often run with limited telemetry, because endpoint agents do not install on a firewall. And they are managed by a small team, sometimes with change control that makes routine inspection uncommon.

An implant on a boundary device sees traffic that has already passed inspection. It can observe the traffic that the organization believes is protected. That vantage point is why the same category of device keeps appearing in intrusion reports.

What to do

Patch first. CVE-2025-25249 has a fixed release for the affected FortiOS, FortiSwitchManager and FortiSASE versions, and the federal deadline has passed. Upgrading removes the entry vector.

Then hunt, because patching does not remove an implant that is already resident. Look for unexpected outbound connections from the appliance, unusual processes, and configuration changes that no administrator made. Compare the running configuration against a known-good baseline and check for VPN accounts, administrative users and firewall rules that appeared without a change ticket.

Rotate the secrets the device holds. If the configuration was harvested, every credential stored on it should be treated as exposed. That includes local administrator accounts, VPN credentials, and any API tokens the appliance uses to talk to management platforms.

Close the management interface. The administrative interface of a firewall should not answer from the public internet. Restrict it to a management network, require multi-factor authentication, and log every administrative session to a system the appliance cannot modify.

Build an inventory of edge devices with their firmware versions and support status. A device past end of support cannot be patched, and the only remaining control is to constrain what it can reach.

References

• SOCRadar, analysis of the PivotC2 campaign against FortiGate devices, September 2026.
• CISA Known Exploited Vulnerabilities catalog entry for CVE-2025-25249, added 9 September 2026.
• NVD entry for CVE-2025-25249, CVSS 7.3 heap buffer overflow.
• Fortinet product security advisories for FortiOS, FortiSwitchManager and FortiSASE.