UnknownPublished 23 Apr 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-04-23

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2023-27997

Description

KRVTZ-NET IDS alerts for 2026-04-23

Impact

The impact is limited to detection of reconnaissance and scanning activity without evidence of successful exploitation or active attacks. The presence of attempts targeting a known Fortigate VPN vulnerability suggests potential interest by threat actors, but no confirmed compromises or widespread exploitation are reported. The low severity rating reflects the informational nature of these alerts and absence of confirmed threat actor activity or damage.

Defensive guidance

No specific mitigation guidance or patches are provided in this report. Since no active exploitation or confirmed threat campaigns are reported, no urgent remediation is indicated. Organizations using Fortigate VPN devices should verify and apply vendor advisories and patches for CVE-2023-27997 as appropriate. Continuous monitoring for suspicious login attempts and scanning activity is recommended.

Indicators of compromise

IP addresses 7

65.49.1.132ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
47.251.170.102TGI HUNT Curl to Bare IP Address
2001:470:1:332::2ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
129.150.44.188ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)
45.148.10.166ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan
170.106.161.38ET USER_AGENTS User-Agent (_TEST_)
43.166.253.58ET USER_AGENTS User-Agent (_TEST_)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 May 2026, 02:22 UTC

Indicators of compromise

IP addresses 7

Community reviews

Related threats