KRVTZ IDS alerts from January 21, 2026, report network reconnaissance targeting Fortigate VPN devices, specifically repeated GET requests to the /remote/logincheck endpoint associated with CVE-2023-27997. This vulnerability allows unauthenticated attackers to bypass authentication and execute arbitrary commands. Additional suspicious scanning includes anomalous HTTP user-agent strings and attempts to access sftp-config.json files to discover exposed credentials. No active exploitation or public patches are currently reported. European organizations, especially in critical infrastructure, finance, and government sectors, are at increased risk. The threat level is medium due to the potential impact if exploited combined with ease of reconnaissance. Defenders should prioritize patching when available, restrict access, and secure credentials to mitigate risk.
The KRVTZ IDS alerts from January 19, 2026, report low-severity reconnaissance and scanning activities targeting AjaxPro Remote Code Execution vulnerability (CVE-2021-23758) and IIS 8.3 web servers. These include brute force attempts, suspicious user-agent strings linked to InfoBot malware, and directory brute forcing. No active exploits or patches are currently associated with these alerts, but early-stage probing could lead to more serious attacks. European countries such as Germany, France, the UK, Netherlands, Italy, Spain, and Poland are highlighted as likely affected due to market presence. The overall threat severity is medium given the potential impact if exploitation occurs.
KRVTZ IDS alerts from January 14, 2026, report automated network reconnaissance and brute force attempts targeting Postfix mail servers. Multiple IP addresses were identified attempting SASL authentication brute forcing, with these attempts detected and blocked. One IP was also flagged for spam activity blocked via DNSBL. These activities represent the reconnaissance phase of attacks, aiming to discover valid credentials or vulnerable configurations. No specific vulnerabilities or exploits are associated, and no patches are available or needed. The threat is low severity due to the lack of successful compromises and absence of denial-of-service indicators. However, persistent brute forcing could lead to credential compromise if defenses are weak. The threat primarily affects European organizations running Postfix servers, with countries like Germany, France, and the UK most likely impacted. Effective monitoring, strong authentication policies, and dynamic IP blocking are critical to mitigating this threat.
