FortiManager Intrusion Exposes 500+ Firewalls and Deploys PEERSTITCH Implant
Summary
Unit 42 says attackers exploited FortiManager and FortiOS flaws to steal configurations and credentials for 500+ firewalls, then used PEERSTITCH, a memory-resident implant, to intercept traffic and maintain access.
Key points
- Unit 42 investigated a September 2024 intrusion at a telecommunications managed service provider, attributed to cluster CL-STA-0954 (UNC5820).
- Attackers exploited CVE-2024-47575 to compromise a FortiManager appliance and exfiltrate configurations, credentials, cryptographic material and network details for more than 500 managed FortiGate firewalls.
- The stolen information enabled attackers to recover credentials and establish unauthorized VPN sessions; Unit 42 says client networks were not examined and reports exposure of configuration and credential material, not confirmed client-network intrusions.
- Attackers used CVE-2025-61624, a FortiOS path-traversal flaw, to gain root-level file access and deploy PEERSTITCH, an ARM64 implant that patches the memory of FortiOS daemons.
- PEERSTITCH operates in memory, uses legitimate processes for covert communication, and modifies VPN-session handling; Unit 42 says it leaves no persistent binary or listening port.
- The attackers also abused Apache mod_md and ACME challenge processing to establish a persistent reverse-shell channel, and impersonated FortiManager to retrieve firewall configurations.
- The report details hunting steps, including checking daemon memory for 16 KB RWX regions, NOP patches, cross-process /proc/mem access and FortiOS auto-script path traversal objects.
Article Details
- Attack Vectors
- The attackers exploited CVE-2024-47575 against a FortiManager appliance through crafted requests to the FMG-Access management channel, registering a rogue Virtual FortiGate and exfiltrating a configuration archive.
- They recovered administrative and SSL/VPN credentials by brute-forcing reversible ciphertext in the stolen configurations, then used the credentials to establish unauthorized FortiGate VPN sessions.
- They pushed unauthorized packet-capture rules to managed FortiGate firewalls to intercept HTTP and other selected network traffic.
- They exploited CVE-2025-61624 through FortiOS auto-script path traversal to write and execute files as root, deploying PEERSTITCH and establishing a reverse-shell channel through Apache mod_md ACME challenges.
- PEERSTITCH used ptrace to inject code into the memory of the /bin/miglogd and /bin/iked daemons, where it monitored traffic and altered process execution.
- The attackers used external infrastructure to host PEERSTITCH components and ACME endpoints, and attempted to impersonate the management platform over FGFM communications.
- Defensive Notes
- Treat credentials, certificates, cryptographic trust material, and configurations held by a compromised management appliance as compromised; rotate them and review the relationships with managed devices.
- Isolate and closely monitor edge-management interfaces and review FortiOS configuration revisions for system.auto-script objects containing path traversal strings.
- For PEERSTITCH hunting, inspect /bin/miglogd and /bin/iked memory maps for anonymous 16 KB RWX regions, verify the listed daemon text offsets for NOP patches, and audit cross-process access to /proc/<pid>/mem.
- Review crash logs and configuration history for injection-related crashes, rogue accounts or VPN groups, and auto-script objects that were subsequently removed.
- The article identifies Next-Generation Firewall with Advanced Threat Prevention signatures 95788 and 96788 as protection against CVE-2024-47575.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 198[.]199[.]122[.]22 | Later-modified external IP associated with the rogue FortiGate registration. |
| IPV4 | 23[.]240[.]77[.]233 | External attacker infrastructure used to host PEERSTITCH files and operate the ACME command-and-control server. |
| IPV4 | 45[.]32[.]41[.]202 | External attacker infrastructure from which a rogue FortiGate was registered with FortiManager. |
| IPV4 | 47[.]18[.]167[.]159 | External infrastructure identified as hosting the PEERSTITCH installer. |
| SHA256 | 829b1cd270b30565739a478441833f49f10a49bd06f0d18cc96c8ae4a0431f11 | SHA-256 hash of the PEERSTITCH ARM64 mmap shellcode bootstrap header. |
| SHA256 | 8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92 | SHA-256 hash of the PEERSTITCH runtime shared-secret-key artifact. |
| SHA256 | 9c4c4436ff5cdf0d6d68f5108031cbf3708a095cde4ef8c09316af7a7110437e | SHA-256 hash of the PEERSTITCH staging and preparation script. |
| SHA256 | b7ae166fd49a7ecfe6322a80b8aa56d6aa0825d8f5d106dab2e4fb7d14ce15a8 | SHA-256 hash of a PEERSTITCH Emscripten WebAssembly module. |
| SHA256 | b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70 | SHA-256 hash of the PEERSTITCH ARM64 executable and core ptrace injector. |
| SHA256 | bd064244dad748cf2a44074bee56f5bfab4a2b18ee944b75d1b3febd4c1fe02a | SHA-256 hash of the PEERSTITCH ARM64 core hook injection data block. |
| SHA256 | f84eea718526706afdf2d1a2774fab76ecb11c18fb61995a37be8249c5e379ab | SHA-256 hash of a PEERSTITCH Emscripten JavaScript runtime component. |
| SHA256 | fc1b10c58057ef9f1f9a1e2a3d4a1c89f43b0ead451398c70ed7a6e0312b36ee | SHA-256 hash of the PEERSTITCH Node.js deployment orchestrator. |
| URL | hxxp[:]//23[.]240[.]77[.]233:8084/acme/authz/1 | Attacker ACME authorization endpoint used in the malicious certificate-authority workflow. |
| URL | hxxp[:]//23[.]240[.]77[.]233:8084/acme/finalize/61924744/774083503 | Attacker ACME finalization endpoint used in the malicious certificate-authority workflow. |
| URL | hxxp[:]//23[.]240[.]77[.]233:8084/acme/new-acct | Attacker ACME account endpoint used in the malicious certificate-authority workflow. |
| URL | hxxp[:]//23[.]240[.]77[.]233:8084/acme/order/11111 | Attacker ACME order endpoint used in the malicious certificate-authority workflow. |
| URL | hxxp[:]//23[.]240[.]77[.]233:8084/directory | Attacker ACME directory endpoint used in the malicious certificate-authority workflow. |
| URL | hxxp[:]//23[.]240[.]77[.]233:8085/pM[.]js | PEERSTITCH staging script URL hosted on attacker infrastructure. |
| URL | hxxp[:]//47[.]18[.]167[.]159:8085/pM[.]js | PEERSTITCH staging script URL hosted on external infrastructure identified in the report. |
MITRE ATT&CK
T1021.004 · SSHThe report describes an SSH-based reverse shell initiated through the malicious ACME challenge.T1040 · Network SniffingThey pushed packet-capture rules to managed firewalls to intercept HTTP and selected TCP and UDP service traffic.T1055 · Process InjectionPEERSTITCH used ptrace and /proc/<pid>/mem to inject payload code into the running miglogd and iked processes.T1057 · Process DiscoveryThe PEERSTITCH injector searched /proc/ and parsed process command lines to locate miglogd and iked.T1059.004 · Unix ShellThe malicious ACME DNS-01 challenge invoked /bin/node with injected shell commands to initiate a reverse shell.T1068 · Exploitation for Privilege EscalationThey exploited CVE-2025-61624 to move from FortiOS administrative access to root-level file access and execution.T1070.004 · File DeletionThe PEERSTITCH injector unlinked its own executable, and the attackers removed rogue configuration objects after execution.T1071.001 · Web ProtocolsThe attackers used the Apache mod_md ACME workflow and attacker-hosted HTTP endpoints for persistent reverse-shell communications.T1078 · Valid AccountsThey used recovered legitimate credentials to establish unauthorized FortiGate SSL/VPN sessions.T1105 · Ingress Tool TransferA script downloaded PEERSTITCH JavaScript, WebAssembly, and native injector components from external infrastructure.T1110.002 · Password CrackingThey brute-forced administrative and SSL/VPN passwords stored as reversible ciphertext in exfiltrated FortiGate configurations.T1190 · Exploit Public-Facing ApplicationThe attackers exploited CVE-2024-47575 against the FortiManager management channel to gain initial access.T1562.001 · Disable or Modify ToolsThe attackers terminated miglogd and syslogd to halt local and remote syslog generation before running malicious scripts.
CVE
CVE-2024-26008It is possible that the attackers forced this session termination using CVE-2024-26008, consistent with the intermittent tunnel management interface drops described in the Anti-Forensics and Defense Evasion sectionCVE-2024-26009Exploitation of CVE-2024-26009 to bypass FGFM authentication using the FortiManager's serial numberCVE-2024-47575The attackers behind CL-STA-0954 achieved an initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance.CVE-2025-61624The attackers exploited another vulnerability, CVE-2025-61624, via FortiOS auto-script path traversal.
Threat Actors
Malware
Vendors
Products
Advanced DNS SecurityAdvanced URL Filtering, Advanced DNS Security and Advanced IP DefenseAdvanced IP DefenseAdvanced URL Filtering, Advanced DNS Security and Advanced IP DefenseAdvanced Threat PreventionNext-Generation Firewall with the Advanced Threat PreventionAdvanced URL FilteringAdvanced URL Filtering, Advanced DNS Security and Advanced IP DefenseAdvanced WildFireThe Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research.Cortex XpanseCortex Xpanse is designed to identify exposed devices and applications on the public internet and escalate these findings to defenders.Device SecurityDevice Security is designed to proactively protect the specialized device attack surface of operational environments, providing deep visibility into industrial protocols, actionable risk insights, and adaptive securityFortiManagerThe attackers behind CL-STA-0954 achieved an initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance.Fortinet FortiGatecryptographic material and database files containing information about more than 500 managed FortiGate firewalls.FortiOSThe attackers exploited another vulnerability, CVE-2025-61624, via FortiOS auto-script path traversal.