KRVTZ-NET IDS alerts for 2026-05-21
The KRVTZ-NET IDS alerts from 2026-05-21 report network activity consistent with reconnaissance targeting Fortigate VPN devices. Specifically, multiple IP addresses were observed making repeated GET requests to the /remote/logincheck endpoint, which is associated with CVE-2023-27997, a known vulnerability in Fortigate VPN. Several other IPs exhibited suspicious or test user-agent strings, indicating scanning or probing behavior. No active exploitation or confirmed compromises are reported. The activity is categorized as low severity due to its reconnaissance nature without evidence of exploitation.
AI Analysis
Technical Summary
This threat intelligence report details IDS alerts capturing network reconnaissance activity focused on Fortigate VPN devices. The key indicator is repeated GET requests to the /remote/logincheck endpoint, linked to CVE-2023-27997, a vulnerability in Fortigate VPN. Additional IP addresses with suspicious or test user-agent strings suggest scanning attempts. There is no indication of active exploitation or confirmed attacks in this data. Patch availability is not confirmed in this report, and no known exploits in the wild are reported.
Potential Impact
The impact is limited to reconnaissance activity that may identify vulnerable Fortigate VPN devices. There is no evidence of successful exploitation or compromise associated with these alerts. The low severity reflects the preliminary nature of the observed network activity without confirmed malicious outcomes.
Mitigation Recommendations
No patch availability is indicated in this report. Organizations should verify that their Fortigate VPN devices are updated according to the latest vendor advisories addressing CVE-2023-27997. Monitoring for unusual or repeated requests to the /remote/logincheck endpoint is recommended to detect potential scanning or probing. Patch status is not yet confirmed here—consult Fortinet's official advisories for current remediation guidance.
Indicators of Compromise
- ip: 2001:470:1:fb5::260
- ip: 43.133.66.51
- ip: 43.131.23.154
- ip: 43.157.98.187
- ip: 43.130.26.3
- ip: 43.157.191.20
- ip: 43.130.101.151
- ip: 43.156.232.190
- ip: 65.49.1.66
- ip: 43.153.192.98
- ip: 43.131.32.36
- ip: 43.130.174.37
- ip: 34.74.242.206
KRVTZ-NET IDS alerts for 2026-05-21
Description
The KRVTZ-NET IDS alerts from 2026-05-21 report network activity consistent with reconnaissance targeting Fortigate VPN devices. Specifically, multiple IP addresses were observed making repeated GET requests to the /remote/logincheck endpoint, which is associated with CVE-2023-27997, a known vulnerability in Fortigate VPN. Several other IPs exhibited suspicious or test user-agent strings, indicating scanning or probing behavior. No active exploitation or confirmed compromises are reported. The activity is categorized as low severity due to its reconnaissance nature without evidence of exploitation.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This threat intelligence report details IDS alerts capturing network reconnaissance activity focused on Fortigate VPN devices. The key indicator is repeated GET requests to the /remote/logincheck endpoint, linked to CVE-2023-27997, a vulnerability in Fortigate VPN. Additional IP addresses with suspicious or test user-agent strings suggest scanning attempts. There is no indication of active exploitation or confirmed attacks in this data. Patch availability is not confirmed in this report, and no known exploits in the wild are reported.
Potential Impact
The impact is limited to reconnaissance activity that may identify vulnerable Fortigate VPN devices. There is no evidence of successful exploitation or compromise associated with these alerts. The low severity reflects the preliminary nature of the observed network activity without confirmed malicious outcomes.
Mitigation Recommendations
No patch availability is indicated in this report. Organizations should verify that their Fortigate VPN devices are updated according to the latest vendor advisories addressing CVE-2023-27997. Monitoring for unusual or repeated requests to the /remote/logincheck endpoint is recommended to detect potential scanning or probing. Patch status is not yet confirmed here—consult Fortinet's official advisories for current remediation guidance.
Technical Details
- Uuid
- 14bc5133-b7b6-46b8-9953-d849b5cb340c
- Original Timestamp
- 1779347223
Indicators of Compromise
Ip
| Value | Description | Copy |
|---|---|---|
ip2001:470:1:fb5::260 | ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997) | |
ip43.133.66.51 | ET USER_AGENTS User-Agent (_TEST_) | |
ip43.131.23.154 | ET USER_AGENTS User-Agent (_TEST_) | |
ip43.157.98.187 | ET USER_AGENTS User-Agent (_TEST_) | |
ip43.130.26.3 | ET USER_AGENTS User-Agent (_TEST_) | |
ip43.157.191.20 | ET USER_AGENTS User-Agent (_TEST_) | |
ip43.130.101.151 | ET USER_AGENTS User-Agent (_TEST_) | |
ip43.156.232.190 | ET USER_AGENTS User-Agent (_TEST_) | |
ip65.49.1.66 | ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997) | |
ip43.153.192.98 | ET USER_AGENTS User-Agent (_TEST_) | |
ip43.131.32.36 | ET USER_AGENTS User-Agent (_TEST_) | |
ip43.130.174.37 | ET USER_AGENTS User-Agent (_TEST_) | |
ip34.74.242.206 | ET USER_AGENTS Suspicious User-Agent (InfoBot) |
Threat ID: 6a0ec353ba1db4736265f12e
Added to database: 05/21/2026, 08:33:23 UTC
Last enriched: 05/28/2026, 21:59:57 UTC
Last updated: 07/29/2026, 13:20:53 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.