The threat involves reconnaissance activity detected by KRVTZ-NET IDS on 2026-03-28, highlighting repeated GET requests to the /remote/logincheck endpoint on Fortigate VPN devices. This activity is linked to CVE-2023-27997, a vulnerability in Fortigate VPN appliances that could allow unauthorized access if exploited. The reconnaissance phase is used by attackers to identify potentially vulnerable systems but does not indicate active exploitation or confirmed attacks. Indicators include IP addresses associated with user-agent testing and exploit attempts. No patch is currently available for this vulnerability, and no known exploits are active in the wild. The event is tagged for automated unsupervised processing and continuous OSINT monitoring.

The impact is currently limited to reconnaissance activities aimed at identifying vulnerable Fortigate VPN devices. There are no reports of active exploitation or ransomware campaigns linked to this activity. If CVE-2023-27997 were successfully exploited, it could lead to unauthorized access to VPN infrastructure, compromising the confidentiality and integrity of remote access sessions and potentially allowing attackers to bypass authentication and gain network footholds. However, the low severity and absence of known exploits suggest limited immediate risk. Exposed Fortigate VPN endpoints remain at risk if patches or mitigations are delayed.

No official patch is currently available for CVE-2023-27997. Organizations should implement strict access controls on Fortigate VPN management interfaces, restricting access to trusted IP addresses only. Enable and monitor detailed logging to detect anomalous login attempts targeting the /remote/logincheck endpoint. Deploy IDS/IPS solutions with updated signatures to identify and block reconnaissance and exploit attempts. Use multi-factor authentication for VPN access and segment VPN infrastructure from critical internal networks. Consider deploying web application firewalls or reverse proxies to filter malicious HTTP requests. Maintain updated threat intelligence feeds and conduct regular vulnerability assessments. Apply vendor security advisories promptly once patches or mitigations become available.