Unit 42 Links PEERSTITCH Implant to FortiManager Breach Affecting 500+ Firewalls

Palo Alto Networks Unit 42 documented a multi-stage intrusion against a telecommunications managed service provider that began in September 2024. The attackers, tracked as cluster CL-STA-0954, compromised a central FortiManager appliance to gain control over hundreds of downstream security devices.

The intrusion started with the exploitation of CVE-2024-47575, known as FortiJump, which allowed unauthenticated registration of a rogue virtual device on the management platform. According to the report, this single compromise enabled the exfiltration of an archive containing running configurations, cryptographic material, and database files for more than 500 managed FortiGate firewalls.

Technical Details of the Breach

The attackers registered the rogue device over TCP port 541, bypassing authentication requirements. Within minutes of gaining access, they extracted a comprehensive configuration archive that included serial numbers, public IP addresses, routing tables, and VPN credentials for every managed firewall. This data also contained cryptographic trust material, effectively providing the intruders with the keys to hundreds of distinct networks protected by the compromised management system.

Following the initial data theft, the attackers deployed PEERSTITCH, a memory-resident malware implant. This stealthy tool helped them maintain persistent access to the telecom provider’s environment while evading detection inside FortiOS memory. The operation allowed the threat group to sustain their presence long after the initial exploitation of the FortiManager appliance.

Scope of Impact

The 500 affected devices did not all belong to the same organization. The compromised FortiGate firewalls protected both the managed service provider’s own infrastructure and the networks of its various clients. Consequently, attackers obtained running configurations and private keys for firewalls belonging to organizations that were unaware of the breach. Unit 42 noted that its investigation covered only the provider’s own environment, not the downstream clients.

Armed with decrypted credentials from the stolen files, which stored passwords as reversible ciphertext, the attackers established unauthorized SSL/VPN sessions. They connected to internal network management segments from external staging addresses, leveraging the stolen trust material to move laterally within the targeted telecommunications organization’s infrastructure.

What should you do?

That suggests organizations relying on centralized management platforms must rigorously monitor for unauthorized device registrations and verify the integrity of configuration archives.

What to do and how to stay safe: FortiManager

• Review FortiManager logs for any unauthorized virtual device registrations or unexpected connections on TCP port 541.
• Audit all managed firewall configurations for signs of tampering or unexpected changes to routing tables and VPN credentials.
• Rotate all cryptographic keys and credentials stored in management consoles, assuming reversible ciphertext may have been exposed.
• Monitor for unusual outbound SSL/VPN sessions originating from internal management segments to external staging addresses.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What vulnerability did the attackers exploit to gain initial access?

The attackers exploited CVE-2024-47575, known as FortiJump, which allowed unauthenticated registration of a rogue virtual device on the FortiManager appliance.

How many firewalls were affected by this breach?

The breach exposed configurations and credentials for more than 500 managed FortiGate firewalls belonging to the provider and its clients.

What malware was used to maintain access?

Attackers deployed PEERSTITCH, a memory-resident implant, to maintain stealthy access and evade detection within the FortiOS environment.