UnknownPublished 10 May 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-05-10

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2023-27997

Description

KRVTZ-NET IDS alerts for 2026-05-10

Impact

The impact is limited to reconnaissance and scanning activity, which may precede exploitation attempts but does not itself indicate a successful compromise. The presence of repeated exploit attempts against Fortigate VPN suggests potential probing for vulnerabilities, but no confirmed exploitation or active threat is reported. No direct impact such as data loss or system compromise is indicated.

Defensive guidance

Organizations should monitor for suspicious traffic matching the provided indicators, especially repeated requests to Fortigate VPN endpoints. Since no official remediation or vendor advisory is provided, standard network monitoring and access controls remain appropriate. Patch status is not applicable for this observation.

Indicators of compromise

IP addresses 13

104.238.50.22ET SCAN Exabot Webcrawler User Agent
92.113.237.84ET SCAN Exabot Webcrawler User Agent
81.21.234.34ET SCAN Exabot Webcrawler User Agent
45.131.92.190ET SCAN Exabot Webcrawler User Agent
150.109.119.38ET USER_AGENTS User-Agent (_TEST_)
2001:470:1:c84::27ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
2001:470:1:c84::16ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
82.25.224.95ET SCAN Exabot Webcrawler User Agent
206.189.103.24ET INFO Request to Hidden Environment File - Inbound
82.23.215.231ET SCAN Exabot Webcrawler User Agent

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 May 2026, 08:36 UTC

Indicators of compromise

IP addresses 13

Community reviews

Related threats