UnknownPublished 30 Apr 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-04-30

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2023-27997

Description

KRVTZ-NET IDS alerts for 2026-04-30

Impact

The impact is limited to detection of reconnaissance and scanning activities. Although there is an indication of attempted exploitation of a Fortigate VPN vulnerability (CVE-2023-27997), there is no evidence of successful exploitation or active compromise. No known exploits in the wild are associated with these alerts. Therefore, the immediate risk to affected organizations is low based on this data.

Defensive guidance

Organizations should ensure that Fortigate VPN devices are updated and patched according to vendor advisories addressing CVE-2023-27997. Since the alerts represent reconnaissance and scanning activity, monitoring network traffic and blocking suspicious IP addresses may help reduce exposure. No urgent remediation is indicated based on this alert set.

Indicators of compromise

IP addresses 8

18.169.25.68ET INFO Request to Hidden Environment File - Inbound
2001:470:1:332::157ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
51.158.204.247ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)
31.57.42.39ET SCAN Exabot Webcrawler User Agent
104.239.37.203ET SCAN Exabot Webcrawler User Agent
216.26.228.196ET INFO Request to Hidden Environment File - Inbound
45.88.138.51ET INFO Request to Hidden Environment File - Inbound
82.26.245.217ET SCAN Exabot Webcrawler User Agent

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 May 2026, 02:21 UTC

Indicators of compromise

IP addresses 8

Community reviews

Related threats