“Sliver” in the Stack: Exposed Logs Reveal Targeted FortiWeb Exploitation Campaign

A sophisticated threat actor has been caught leveraging exposed logs and databases to orchestrate a targeted campaign against FortiWeb appliances, using the open‑source Sliver C2 framework to maintain persistent access. The operation, uncovered by threat researcher c0baltstrik3d during routine open-directory threat hunting, onboarded 30 unique victims in just eight days between 22 December and 30 December 2025.

The attackers used React2Shell (CVE-2025-55182) to deploy Sliver on victim hosts, and, while the exact breach method remains unconfirmed due to a lack of a recovered PoC, the researchers noted that the threat actor had successfully exploited multiple FortiWeb devices according to ctrlaltintel threat research/FortiWeb-Sliver/. Inside the networks, they deployed Fast Reverse Proxy to expose local services remotely, bypassing firewalls and maintaining access.

They also masked malicious traffic by renaming the microsocks binary to cups-lpd and binding it to port 515, a tactic aimed at blending in with legitimate CUPs printer communications, and used Bangladesh-themed decoy pages alongside C2 infrastructure linked to Bangladesh‑targeted victims in Pakistan and Bangladesh.