InfoSecBulletin Cybersecurity for mankind
Threat researchers found a sophisticated attack campaign aimed at FortiWeb firewalls worldwide, using the Sliver C2 framework for ongoing access and hidden proxy setups.
Analyzing exposed Silver C2 databases and logs during open-directory threat hunting on Censys revealed a coordinated attack exploiting vulnerabilities in outdated FortiWeb devices.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
The threat actor gained initial access by exploiting public-facing vulnerabilities on multiple FortiWeb appliances, specifically targeting outdated versions ranging from 5.4.202 to 6.1.62.
Researchers found that the attacker used React2Shell (CVE-2025-55182) and some unknown FortiWeb vulnerabilities to compromise the victim’s infrastructure.
The lack of proof-of-concept code for the FortiWeb exploits suggests the threat actor may have been targeting zero-day vulnerabilities or leveraging weaponized exploits not yet disclosed publicly.
Command-and-Control Infrastructure:
The investigation found two main C2 domains: ns1.ubuntupackages[.]store and ns1.bafairforce[.]army, which both host Sliver instances.
The threat actor showed skill by creating fake websites that mimicked real services, including a false Ubuntu Packages repository and a counterfeit Bangladesh Air Force recruitment page.
The first C2 domain was registered in September 2024, but victim onboarding sped up significantly from December 22-30, 2025, with 30 hosts compromised in eight days.
The adversaries established persistence through systemd services and supervisor configuration modifications, disguising the Sliver binary as a system updater process at /bin/.root/system-updater.
To facilitate command execution and lateral movement, the threat actor deployed Fast Reverse Proxy (FRP) and a disguised microsocks SOCKS proxy renamed as “cups-lpd,” bound to port 515 to masquerade as the legitimate CUPS Line Printer Daemon. This deception tactic demonstrates considerable operational discipline.
Victimology analysis showed targeted attacks in Pakistan and Bangladesh, affecting many victims in the finance and government sectors.
The choice of Bangladesh-themed decoy infrastructure aligns with observed victim locations, suggesting the operation was more targeted than opportunistic.
Analysing the binary we can see this will expose the SOCKS service on port 515, which is noteable as this is the expected port that the legitimate Linux CUPS Line Printer Daemon will listen on.
However, the broader threat lies in a fundamental security blindspot: FortiWeb appliances and similar edge devices typically lack built-in endpoint detection and response (EDR) capabilities, and organizations rarely deploy aftermarket security tools.
Victim:
In the recovered C2 databases, excluding FP or sandbox hostnames, there were 30 unique IP addresses actively beaconing. Victims were noted in Pakistan and Bangladesh, particularly in the financial and government sectors.
IOCs:
Source: gbhackers.com, ctrlaltintel.com
