UnknownPublished 18 Mar 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-03-18

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2023-27997

Description

KRVTZ-NET IDS alerts for 2026-03-18

Impact

If exploited, CVE-2023-27997 could enable unauthorized remote access to internal networks via Fortigate VPN devices, potentially leading to data breaches, lateral movement, and disruption of VPN services. The current alert indicates only reconnaissance activity without confirmed exploitation or known active exploits. The presence of suspicious scanning and user-agent spoofing suggests active interest from threat actors. The impact of successful exploitation could be significant given the critical role of VPN infrastructure in secure remote access.

Defensive guidance

Organizations should audit Fortigate VPN deployments to identify exposed /remote/logincheck endpoints and verify if they are running vulnerable versions. Applying the latest Fortinet security advisories and firmware updates addressing CVE-2023-27997 is recommended when available. Implement strict access controls such as IP whitelisting and multi-factor authentication on VPN gateways. Deploy IDS/IPS with updated signatures to detect repeated GET requests targeting /remote/logincheck. Monitor VPN logs for anomalous authentication attempts and suspicious user-agent strings. Consider network segmentation to limit lateral movement if VPN access is compromised. Regularly update threat intelligence feeds and conduct vulnerability assessments focused on VPN infrastructure.

Summary

The threat intelligence report highlights reconnaissance activity targeting Fortigate VPN devices by sending repeated GET requests to the /remote/logincheck endpoint, associated with CVE-2023-27997. This vulnerability could allow attackers to bypass authentication controls on vulnerable Fortigate VPN versions. The report includes multiple IP addresses involved in scanning and suspicious user-agent activity. No confirmed exploitation or known exploits in the wild are reported. Patch availability is currently unconfirmed, and the activity is categorized as low severity reconnaissance within the cyber kill chain.

Indicators of compromise

IP addresses 4

2001:470:1:c84::17ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
103.216.51.246ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)
125.209.235.172ET SCAN Naver Webcrawler User-Agent (Naver.me)
110.93.150.70ET SCAN Naver Webcrawler User-Agent (Naver.me)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 May 2026, 02:24 UTC

Indicators of compromise

IP addresses 4

Community reviews

Related threats