KRVTZ-NET IDS detected multiple suspicious network activities on 2026-03-21. An IP address (172.245.195.56) showed possible brute force behavior against a submission service over TCP. Another IP (2001:470:2cc:1:868e:f01b:ee87:8e35) made repeated GET requests to the /remote/logincheck endpoint on Fortigate VPN devices, associated with CVE-2023-27997, a vulnerability allowing authentication bypass. Additional IPs made inbound requests to hidden environment files, which attackers often target to obtain sensitive environment variables or credentials. These alerts represent reconnaissance activity in the attack kill chain, with no confirmed exploitation or active attacks reported.

The immediate impact is low as the activity is primarily reconnaissance and scanning. However, brute force attempts against submission services could lead to unauthorized access if weak credentials are present. Exploit attempts targeting Fortigate VPN devices could allow attackers to bypass authentication and gain unauthorized access, risking exposure of internal networks and sensitive data. Requests to hidden environment files may reveal secrets if improperly secured, facilitating further compromise. No active exploitation or ransomware campaigns are confirmed at this time.

No official patch or direct remediation is referenced in this report. Organizations should ensure Fortigate VPN devices are updated with the latest security patches addressing CVE-2023-27997. Implement strong authentication controls on submission services, including rate limiting, account lockout, and multi-factor authentication to mitigate brute force attempts. Restrict access to hidden environment files by configuring web servers and applications to deny such requests and audit for exposed secrets regularly. Monitor VPN and submission service logs for unusual access patterns and repeated failed login attempts. Deploy intrusion detection and prevention systems with updated signatures to detect and block known exploit attempts. Network segmentation and threat intelligence sharing can enhance detection and response capabilities.