How Adversaries Are Turning the Vulnerability Ecosystem Against Defenders

A vulnerability in Fortinet's FortiOS and FortiProxy (CVE-2024-55591) was referenced in data seized by CrowdStrike Counter Adversary Operations from an adversary named STATIC KITTEN in February 2026. The seized material included a modified Proof-of-Concept (POC) exploit that advanced significantly beyond the original public version released on January 27, 2025. While the initial POC allowed command execution by a single user input, the version found contained thirteen distinct hardcoded payloads designed for comprehensive adversarial activity, such as privilege escalation, user creation, and persistence establishment. The analysis also addresses the broader acceleration of vulnerability weaponization due to advancements in Artificial Intelligence, noting that threat actors are augmenting their research through direct interaction with AI models, modifying open-weight systems, or adopting published public findings.
The threat landscape is described as highly volatile, suggesting that patch prioritization based solely on standard scoring metrics is insufficient. Evidence indicates that vulnerabilities accompanied by a public POC are weaponized in the wild exceptionally rapidly—with 91% being exploited within 48 hours of disclosure. This speed forces defenders to treat patching timelines as effectively zero. The increased democratization of offensive capability, evidenced by adversaries across skill levels operationalizing readily available research, raises the barrier for sophisticated defense strategies.
Uncertainty remains regarding whether STATIC KITTEN modified the public exploit themselves or obtained it elsewhere. Furthermore, while AI augmentation is pervasive in vulnerability discovery, definitive attribution linking specific attacks to direct AI involvement beyond the use of published material is currently difficult.

CrowdStrike Counter Adversary Operations identified open directory data on IP address 157.20.182[.]49 in February 2026.
The adversary associated with the activity is named STATIC KITTEN, originating from Iran-nexus activities.
The data contained a modified POC exploit for CVE-2024-55591 affecting FortiOS and FortiProxy.
The original public POC exploit for CVE-2024-55591 was released on January 27, 2025.
The unmodified public POC allowed the execution of a single user-provided command.
The modified version included thirteen hardcoded payloads targeting enumeration, user creation, and persistence.
One payload (test) creates an admin backdoor account named FortiWiFi with password FortiWiFi123 and superadmin profile.
Another high-privilege payload (test11) creates a 'FortiSetup' system admin account with root VDOM access.
The analysis notes that 91% of vulnerabilities with POCs seen by CrowdStrike were weaponized within 48 hours in the first half of 2026.

This material functions as a high-level threat intelligence brief disguised partially as academic observation, leveraging specific forensic findings (STATIC KITTEN's payload structure) to build a macro argument about systemic vulnerability management failure. The narrative's core persuasive drive is the necessity of radically altering security operations—moving beyond CVSS scores toward real-time exploitability intelligence—by framing AI and rapid public disclosure as inevitable evolutionary pressures.
The strongest iteration of this narrative posits that the convergence of easily accessible, sophisticated exploits (like the expanded CVE-2024-55591 payload suite) and AI-accelerated research fundamentally collapses traditional defensive timelines to near zero. This argument relies heavily on quantified immediacy: the 35-minute observation time cited underscores a critical pressure point for defenders, suggesting that preparedness must transition from scheduled patching cycles to continuous, hyper-reactive operational capability.
The pattern of presenting granular, technical evidence (the detailed payload table) immediately followed by abstract, macro implications (patch prioritization is harder than ever) functions as a strong anchoring technique. The threat intelligence serves to validate the high stakes of the systemic commentary that follows. While the specific malware modification is concrete, the extrapolation regarding *all* future adversary behavior hinges on assuming this pattern—public exploit $\rightarrow$ immediate weaponization—is invariant across all vulnerability classes.
Patterns detected: ARC-0142 Problem/Solution Imbalance (The problem presented is existential in scope while the proposed solutions remain abstract operational shifts).
Patterns detected: ARC-0038 Authority Game (Relying on CrowdStrike's specific, proprietary observations of timelines to dictate industry-wide operational mandates).
ROOT CAUSE: The prevailing paradigm assumes that security posture can be managed through linear, scheduled risk assessments. This narrative challenges that assumption by presenting the reality of decentralized, high-speed information warfare where adversaries are not monolithic but a broad spectrum empowered by accessible tools and collective knowledge propagation.
IMPLICATIONS: Human agency is being increasingly constrained not by poor technical skill on the part of an adversary, but by the velocity mismatch between offensive innovation (AI/POCs) and defensive procedural inertia. The cost is borne by organizations whose risk management processes are designed for a pre-internet, slower cycle of disclosure. Second-order consequences include the possible weaponization of public security research itself as a force multiplier against governance structures.
BRIDGE QUESTIONS: Given that defenses must react in minutes, how can vulnerability intelligence firms effectively shift from providing advisories to delivering real-time operational mitigation instruction? If patch prioritization is functionally dictated by "adversary intent," what observable behaviors offer the earliest credible signal of targeted malicious interest? How might defensive architectures evolve if they assume the availability of a weaponized POC is equivalent to an active breach notification?
COUNTERSTRIKE SCAN: A sophisticated influence campaign would use precise, fear-laden timelines (35 minutes) coupled with technical specificity (CVE/payloads) to force immediate organizational panic, bypassing thoughtful resource allocation discussions. The actual content aligns closely with this pattern by using the high immediacy of the payload analysis to drive the subsequent calls for radical changes in patching philosophy.
Autonomy check: No autonomy signals.