# EKZ Infostealer Campaign — FortiClient EMS CVE-2026-35616 Abused via on_connect Script Injection (Arctic Wolf, May 2026)

> Arctic Wolf identified a May 2026 intrusion set exploiting CVE-2026-35616 (a critical pre-authentication API access control bypass in Fortinet FortiClient EMS 7.4.5-7.4.6) to silently modify Remote Access Profiles on managed endpoints and weaponize FortiClient's legitimate on_connect IPsec tunnel script directive. The exploitation chain causes fortitray.exe (or ipsec.exe) to spawn GUID-named .cmd scripts under C:\Program Files\Fortinet\FortiClient\logs\Trace\scripts\, which decode base64-encoded PowerShell that retrieves FortiEndpoint_Patch.exe from hxxp://83.138.53.110/dl/p.exe — a previously undocumented MinGW-compiled Windows credential stealer designated EKZ Infostealer. EKZ targets Chromium-family (Chrome, Edge) and Gecko-family (Firefox, LibreWolf, Thunderbird) browsers, abuses the Google Chrome Elevation Service via IElevator::DecryptData to extract the v20 AES-256 master key, dynamically loads nss3.dll for Firefox credential decryption, and exfiltrates harvested passwords, session cookies, and autofill data on a 90-second delayed HTTP POST schedule.

- **Published:** 2026-05-27T00:00:00Z
- **Last reviewed:** 2026-10-16T01:56:02.416Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0611
- **ID:** TL-2026-0611
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-35616

## Description

Overview

On 28 May 2026 Arctic Wolf publicly disclosed an active threat campaign in which an unidentified financially motivated actor exploited CVE-2026-35616, a critical (CVSS 9.8) improper access control flaw in Fortinet FortiClient Endpoint Management Server (EMS) API authentication, as the initial access vector to weaponize trusted endpoint management infrastructure for mass credential theft. The campaign delivered a previously undocumented Windows infostealer that Arctic Wolf designated EKZ Infostealer, named from internal symbol strings recovered from the decrypted code. The campaign represents a textbook misuse-of-legitimate-feature attack: rather than relying on novel implants for persistence, the actor abused FortiClient's documented on_connect script directive — which executes scripts upon IPsec VPN tunnel establishment — to achieve recurring code execution under SYSTEM context every time the user connects to the corporate VPN.

Initial Access and Vulnerability

CVE-2026-35616 (CWE-284, Improper Access Control) was published by Fortinet on 4 April 2026 under advisory FG-IR-26-099, with credit to Simo Kohonen of Defused and Nguyen Duc Anh. The flaw affects FortiClient EMS 7.4.5 and 7.4.6 and permits an unauthenticated remote attacker to bypass API authentication and issue privileged requests against the EMS management API (TCP/8013 in default deployments). FortiClient EMS 7.4.7 contains the fix; FortiClient Cloud and FortiSASE customers were remediated server-side. watchTowr's Attacker Eye sensors observed in-the-wild exploitation as early as 31 March 2026, four days before Fortinet's coordinated disclosure, indicating the vulnerability was a zero-day at the time of initial use. CISA added CVE-2026-35616 to the Known Exploited Vulnerabilities catalog on 6 April 2026 with a federal mitigation deadline of 9 April 2026.

Weaponization — on_connect Script Injection

After authenticating to the EMS API via the bypass, the actor modifies the organization's Remote Access Profile and endpoint policy, injecting a malicious on_connect script directive. The on_connect feature is a documented FortiClient capability that executes administrator-defined scripts when an IPsec tunnel is established; it is designed for legitimate post-connection automation (drive mapping, banner display) and runs in the context of the FortiClient service. EMS pushes the modified policy to every managed endpoint, and on the next VPN connection the on_connect script materializes on the endpoint at C:\Program Files\Fortinet\FortiClient\logs\Trace\scripts\{GUID}.cmd, where {GUID} is a fresh UUID generated per push. fortitray.exe (the FortiClient system-tray host) or ipsec.exe (the VPN tunnel handler) invokes cmd.exe to execute the .cmd file, which in turn launches powershell.exe with a base64-encoded -EncodedCommand payload. The PowerShell stage downloads FortiEndpoint_Patch.exe (also named p.exe in transit) from hxxp://83.138.53.110/dl/p.exe and executes it with no on-disk staging beyond the binary itself, sleeping for approximately 90 seconds before issuing an HTTP POST to the same host to confirm execution and stage exfiltration.

EKZ Infostealer Capabilities

FortiEndpoint_Patch.exe is a MinGW-compiled (GCC for Windows) PE32+ binary masquerading as a legitimate Fortinet patch. Reverse-engineering by Arctic Wolf revealed the implant calls itself EKZ in internal symbol strings. The malware enumerates installed browsers via the Windows registry and selects from two distinct credential-extraction paths:

  Chromium-family (Google Chrome, Microsoft Edge, Brave, and other v20-AES-256 derivatives): EKZ stages a self-copy into the targeted browser's Application\ directory to satisfy the Elevation Service's path-validation check, then invokes the legitimate Google Chrome Elevation Service via the IElevator COM interface, specifically IElevator::DecryptData. This call returns the cleartext v20 master AES-256 key that protects the SQLite-based Login Data and Cookies databases — bypassing the DPAPI-bound user-context decryption requirement that has historically forced stealers to run as the logged-in user.

  Gecko-family (Mozilla Firefox, LibreWolf, Mozilla Thunderbird): EKZ dynamically loads nss3.dll from the targeted application's install directory and uses NSS_Init, PK11SDR_Decrypt, and related APIs to decrypt key4.db (master key store), logins.json (saved credentials), and cookies.sqlite (browser cookies) directly in process.

All harvested material — passwords, session cookies, credit card autofill, and browser autocomplete entries — is concatenated to a plaintext file at C:\ProgramData\log.txt and exfiltrated to the C2 (83.138.53.110) on a timed schedule via HTTP POST. Arctic Wolf explicitly highlights that stolen session cookies enable account takeover even where MFA protections are in place, because valid post-authentication cookies bypass the MFA challenge entirely.

Post-Exploitation Activity

Within hours of successful credential exfiltration, Arctic Wolf observed authentication attempts from Tor exit nodes 185.220.101.15 and 192.42.116.14 against the victim's perimeter and SaaS identity providers — consistent with hands-on-keyboard validation of stolen cookies and credentials. The malware itself does not appear to implement lateral movement or post-exploitation tooling; the actor appears to operate a steal-validate-monetize tradecraft model in which the EKZ implant is solely a harvester and human operators perform follow-on intrusion.

Attribution and Motivation

No public attribution has been issued. The campaign's tradecraft — exploitation of a recently disclosed enterprise CVE for opportunistic mass deployment, financially monetizable credential and cookie theft, and Tor-fronted follow-on access — is consistent with cybercriminal initial access broker (IAB) operations rather than nation-state activity. Attribution confidence is LOW. The presence of EKZ as an apparently bespoke (not commodity) infostealer suggests either a tooled-up criminal crew or a small custom-tool ecosystem rather than reuse of mainstream stealer-as-a-service families (RedLine, Lumma, StealC).

Defensive Posture

Patching FortiClient EMS to 7.4.7+ remediates the initial access vector. Detection focuses on (1) FortiClient EMS API access from unexpected sources or with anomalous request volume targeting Remote Access Profile endpoints; (2) GUID-named .cmd file creation under C:\Program Files\Fortinet\FortiClient\logs\Trace\scripts\; (3) parent-child anomalies where fortitray.exe or ipsec.exe spawns cmd.exe → powershell.exe with -EncodedCommand; (4) outbound TCP to 83.138.53.110 or related infrastructure; (5) network connections to nss3.dll-bearing browser process trees from non-browser parents. All credentials and session cookies on managed endpoints exposed to a vulnerable EMS should be considered compromised pending rotation.

## MITRE ATT&CK

- T1595 Active Scanning
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1559 Inter-Process Communication
- T1505 Server Software Component
- T1546 Event Triggered Execution
- T1548 Abuse Elevation Control Mechanism
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1218 System Binary Proxy Execution
- T1564 Hide Artifacts
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1012 Query Registry
- T1518 Software Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1185 Browser Session Hijacking
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1029 Scheduled Transfer
- T1531 Account Access Removal
- T1070.004 Indicator Removal
- T1090.003 Proxy
- T1072 Software Deployment Tools
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1074.001 Data Staged: Local Data Staging
- T1071.001 Application Layer Protocol: Web Protocols

## Sources

- [Cyber Security News — FortiClient Code Execution Vulnerability Exploited to Deploy EKZ Malware](https://cybersecuritynews.com/forticlient-code-execution-vulnerability/)
- [Arctic Wolf — CVE-2026-35616 Security Bulletin](https://arcticwolf.com/resources/blog/cve-2026-35616/)
- [Malware.news — FortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet Patch](https://malware.news/t/forticlient-ems-exploited-via-cve-2026-35616-to-deliver-ekz-infostealer-disguised-as-a-fortinet-patch/107373)
- [Fortinet PSIRT Advisory FG-IR-26-099 — FortiClient EMS Improper Access Control](https://fortiguard.fortinet.com/psirt/FG-IR-26-099)
- [NVD — CVE-2026-35616 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-35616)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2026-35616](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [watchTowr — Fortinet FortiClient EMS Zero-Day CVE-2026-35616 Active Exploitation Underway](https://watchtowr.com/resources/fortinet-forticlient-ems-zero-day-cve-2026-35616-active-exploitation-underway/)
- [SOCRadar — CVE-2026-35616 FortiClient EMS API Auth Bypass Enables Command Execution](https://socradar.io/blog/cve-2026-35616-forticlient-ems-auth-bypass/)
- [eSecurity Planet — CVE-2026-35616 FortiClient EMS Flaw Under Active Exploitation](https://www.esecurityplanet.com/threats/cve-2026-35616-forticlient-ems-flaw-under-active-exploitation/)
- [NetSPI — CVE-2026-35616 & CVE-2026-21643 Fortinet FortiClientEMS Overview & Takeaways](https://www.netspi.com/blog/executive-blog/critical-vulnerability/cve-2026-35616-cve-2026-21643-fortinet-forticlientems-overview-takeaways/)
- [runZero — Fortinet FortiClient EMS vulnerability CVE-2026-35616](https://www.runzero.com/blog/fortinet-forticlient-ems/)
- [HoplonInfosec — Fortinet CVE-2026-35616 Exploit Patch FortiClient EMS](https://hoploninfosec.com/fortinet-cve-2026-35616-patch)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0611