UnknownPublished 15 Apr 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-04-15

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2023-27997

Description

KRVTZ-NET IDS alerts for 2026-04-15

Impact

The impact is primarily reconnaissance and potential information leakage through exposed configuration files related to SFTP/FTP and Visual Studio Code. The repeated exploit attempts on Fortigate VPN devices indicate attempts to leverage CVE-2023-27997, which could allow unauthorized access if successfully exploited. However, there are no confirmed cases of exploitation or active threat campaigns associated with these alerts. The overall risk is low at this stage, focused on information gathering rather than direct compromise.

Defensive guidance

Patch status for the Fortigate VPN vulnerability (CVE-2023-27997) is not confirmed in this report; users should consult the Fortigate vendor advisory for current remediation guidance. Organizations should verify that sensitive configuration files such as sftp-config.json and sftp.json are not publicly accessible. Following vendor recommendations for securing Fortigate VPN devices is advised.

Indicators of compromise

IP addresses 3

2a09:bac1:6560:8::277:7eET SCAN SFTP/FTP Password Exposure via sftp-config.json
2a09:bac1:6500:8::277:7eET INFO Request for Visual Studio Code sftp.json - Possible Information Leak
2001:470:2cc:1:aa38:a6e5:3d15:b80eET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 May 2026, 02:24 UTC

Indicators of compromise

IP addresses 3

Community reviews

Related threats