UnknownPublished 15 Mar 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-03-15

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2023-27997

Description

KRVTZ-NET IDS alerts for 2026-03-15

Impact

The immediate impact is low since the activity is limited to reconnaissance without confirmed exploitation. However, accessing PHP info pages and git repositories could expose sensitive configuration details or source code, aiding future attacks. The repeated attempts to access the Fortigate VPN login endpoint suggest targeting of a known vulnerability (CVE-2023-27997), which if exploited, could allow unauthorized VPN access and compromise network confidentiality and integrity. Organizations running Fortigate VPN appliances or vulnerable web servers globally are at risk of follow-on attacks if these reconnaissance efforts lead to successful exploitation.

Defensive guidance

Restrict or disable access to sensitive web server endpoints such as phpinfo pages and git repositories to reduce information leakage. Deploy web application firewalls (WAFs) and intrusion detection/prevention systems to detect and block unauthorized scanning and probing attempts. Implement targeted monitoring for suspicious network activity and automate blocking of offending IP addresses. Conduct regular vulnerability assessments and penetration testing to identify and remediate exposed services. Maintain network segmentation and incident response plans to quickly address reconnaissance and potential exploitation attempts.

Indicators of compromise

IP addresses 5

41.143.48.201ET WEB_SERVER WEB-PHP phpinfo access
192.253.248.12TGI HUNT gitrepo HTTP Probe
45.148.10.231ET WEB_SERVER WEB-PHP phpinfo access
2001:470:2cc:1::1dfET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
43.130.131.18ET USER_AGENTS User-Agent (_TEST_)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 May 2026, 02:25 UTC

Indicators of compromise

IP addresses 5

Community reviews

Related threats