An Iranian state-backed hacking group took a public proof-of-concept exploit for a Fortinet firewall flaw and rebuilt it into a 13-payload kit for planting backdoor administrator accounts, according to new research from CrowdStrike Counter Adversary Operations by Lacie Blythe and Jaime Duque. The finding anchors a broader CrowdStrike analysis showing how quickly attackers now turn published security research into working attacks.
CrowdStrike tracks the group as STATIC KITTEN, a name IntelFusions lists as an alias of MuddyWater. In February 2026 the company's researchers found an open directory controlled by the group on 157[.]20[.]182[.]49, holding 1.9 GB of data and more than 20,000 files.
One command became thirteen backdoor payloads
Among those files was a modified version of a public proof of concept (PoC), the demonstration code researchers release to prove a bug is real, for CVE-2024-55591, an authentication bypass in Fortinet's FortiOS and FortiProxy. The original PoC, first released by an industry source on January 27, 2025, ran a single command supplied by the user. The STATIC KITTEN copy carried 13 hardcoded payloads built to enumerate a target, create users and establish persistence.
CrowdStrike's breakdown of those payloads shows a methodical approach:
- Several create or reset an account named FortiWiFi and grant it the super_admin profile, giving full control of the device, then add it to SSL VPN user groups.
- One builds a VPN group that mixes the FortiWiFi backdoor with users bearing transliterated Hebrew-language names, which CrowdStrike assesses was potentially meant to hide the backdoor among legitimate users.
- The most sophisticated creates a system administrator called FortiSetup with super_admin privileges and root VDOM access.
- Others add users named darlen and offices, the latter with an email address that CrowdStrike suggests was added to make the account look legitimate.
CrowdStrike says it does not know whether STATIC KITTEN modified the exploit itself or obtained it elsewhere, and it has not seen any other adversary using this version or the infrastructure hosting it.
Public exploits are reaching attackers within hours
The case sits inside a wider set of numbers. Looking at in-the-wild exploitation it observed between January and July 2026, CrowdStrike says the median time from a public PoC to threat actors exploiting the vulnerability was less than one day, and the fastest was 35 minutes. Of the vulnerabilities with a public PoC that it saw exploited, 91 percent were exploited within 48 hours of the PoC's release. That updates the 88 percent figure the company gave for January to June in its 2026 Threat Hunting Report.
Two other examples show the same pattern. On April 30, 2026, the Belarus-nexus adversary CrowdStrike calls UMBRAL BISON used a modified version of the public CopyFail Linux exploit (CVE-2026-31431) at a Ukrainian government entity to escalate from the www-data web user to root, then tried to deploy a Mythic Poseidon C2 agent that CrowdStrike's sensor terminated. The group had reworked the PoC to hide its logic from static analysis and added error handling to make it more reliable. In the cPanel authentication bypass CVE-2026-41940, CrowdStrike found that a published detection tool needed only one line un-commented to become a working exploit that changes the root password, and widespread exploitation began the next day. Retrospective hunting showed a single actor had likely been exploiting the flaw as a zero-day since at least April 3, 2026. IntelFusions covered that cPanel exploitation at the time.
Patch CVE-2024-55591 and hunt for FortiWiFi accounts
Organizations running FortiOS or FortiProxy should confirm they are on a release that fixes CVE-2024-55591, following Fortinet's advisory for exact versions. Because the payloads leave accounts behind, patching alone is not enough: review administrator and local user lists for unexpected entries such as FortiWiFi, FortiSetup, darlen or offices, and check SSL VPN groups for unexplained membership changes. CrowdStrike's broader advice is to prioritize patching on real-world exploitability and the existence of public exploit code rather than CVSS scores alone.
Indicators (defanged):
- STATIC KITTEN open directory: 157[.]20[.]182[.]49
- Modified CVE-2024-55591 exploit (SHA256): fd6b46d148af22da6163f18ce43b35ebb827cc6e140f03f0f514bc2a6f548743
- UMBRAL BISON modified CopyFail exploit (SHA256): de8d1b25e8965dc98c62d675ee7c451ed12502194890f6cc691322ad66f3abf4
A firewall bug from early 2025 should be old news. CrowdStrike's research shows why it is not: once exploit code is public, it keeps getting rebuilt by whoever finds a use for it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.