This threat report details network reconnaissance activities detected by KRVTZ-NET IDS on 2026-04-15. Indicators include IP addresses involved in scanning for exposed SFTP/FTP password configuration files (sftp-config.json), requests for Visual Studio Code sftp.json files that could leak sensitive data, and repeated exploit attempts against Fortigate VPN devices targeting CVE-2023-27997 via /remote/logincheck GET requests. The report does not confirm active exploitation or provide patch status. The observed activities suggest attempts to gather information that could be leveraged in future attacks.

The impact is primarily reconnaissance and potential information leakage through exposed configuration files related to SFTP/FTP and Visual Studio Code. The repeated exploit attempts on Fortigate VPN devices indicate attempts to leverage CVE-2023-27997, which could allow unauthorized access if successfully exploited. However, there are no confirmed cases of exploitation or active threat campaigns associated with these alerts. The overall risk is low at this stage, focused on information gathering rather than direct compromise.

Patch status for the Fortigate VPN vulnerability (CVE-2023-27997) is not confirmed in this report; users should consult the Fortigate vendor advisory for current remediation guidance. Organizations should verify that sensitive configuration files such as sftp-config.json and sftp.json are not publicly accessible. Following vendor recommendations for securing Fortigate VPN devices is advised. Since no official patch or mitigation details are provided here, checking vendor advisories is essential to ensure appropriate protection.