CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT

**SOCRadar STRU reports active exploitation of CVE-2025-25249 (FortiOS cw_acd heap overflow) delivering PivotC2, a Node.js RAT that provides persistent TLS C2, multi-channel tunneling, FortiGate configuration harvesting and credential decryption; the campaign targeted ~30,000 IPs with 178 confirmed infections (two full intrusions with data exfiltration), is Russian-speaking and financially motivated, and includes detailed IoCs, exploit analysis, and mitigation recommendations.**