Threat Actor Compromises Legacy FortiWeb Appliances to Deploy Sliver C2 for Stealthy Persistent Access

• BY Rishabh Tiwari
• January 5, 2026
• 0 Comments

Introduction Security researchers have uncovered an active intrusion campaign in which a sophisticated threat actor is exploiting outdated Fortinet FortiWeb web application firewall appliances to deploy the Sliver Command and Control framework. The activity underscores a growing risk associated with unpatched edge devices, which continue to be attractive footholds for attackers seeking long-term, stealthy access […]