← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
FortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet Patch - Arctic Wolf
WHITE CyberHunter_NL 2026-05-28 Modified: 2026-05-28
13
IOCs
MEDIUM VOLUME
What do you need to know about security operations and how to get them in the best possible position to protect your business from cyber attacks and breaches? and what can you learn about this new platform?
arctic wolfforticlient emspowershellekz infostealercve202635616httpremote accesschromehttp postfirefoxwolf
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
EKZ Infostealer
Indicators of Compromise (5 / 13 total)
All CVE FileHash-MD5 FileHash-SHA1 FileHash-SHA256 IPv4
TYPEINDICATORDESCRIPTIONCREATED
FileHash-SHA256 0da123adf9251957a4b850a3f6bd6a753dd4892be176a84a18450e899534cc5e SHA256 of 17e771c78430cc67e71d4547f8996a1a488e9d3f 2026-05-28
FileHash-SHA256 2927bc31b4f8254c6b332fc03110a6373cad00ffa2ff9de427c26bb222017bb2 — 2026-05-28
FileHash-SHA256 2f25ea1b622abf3212141af932c2ec4cbd6b2b5903c2a531121f691227d98cff — 2026-05-28
FileHash-SHA256 d91c00fad521e76efa89715cca89db487d5676f2c767c883482f9c8f82bd383a — 2026-05-28
FileHash-SHA256 fd65051c61a904a304919c04a8c8633c001183ac73ac461cd4d9057946f02bf5 — 2026-05-28
References (1)
↗ https://arcticwolf.com/resources/blog/forticlient-ems-exploited-via-cve-2026-35616-to-deliver-ekz-infostealer-disguised-as-a-fortinet-patch/