Unit 42 Links Peerstitch Malware to FortiOS Exploit After FortiManager Breach
Attackers used CVE-2024-47575 to compromise a telecom provider’s FortiManager, stealing credentials to deploy new memory-resident malware on firewalls.
Key points
- Unit 42 identified a September 2024 intrusion where attackers exploited CVE-2024-47575 in FortiManager to steal configurations for over 500 FortiGate devices.
- The group deployed Peerstitch, a previously undocumented ARM64 malware, by exploiting a separate privilege-escalation flaw, CVE-2025-61624, in FortiOS.
- Peerstitch operates entirely in memory without creating disk files or opening ports, using legitimate processes to evade standard detection methods.
Palo Alto Networks’ Unit 42 threat intelligence team reported a complex cyber intrusion against a telecommunications managed service provider in September 2024. The attackers compromised the organization’s FortiManager appliance by exploiting CVE-2024-47575, a vulnerability that allowed them to steal sensitive configurations, credentials, and cryptographic material associated with more than 500 managed FortiGate firewalls.
The investigation revealed that the threat actors used the compromised management platform to map the network topology, intercept traffic, and establish unauthorized virtual private network sessions. According to Industrial Cyber, Unit 42 stated that the stolen information exposed the provider’s infrastructure and the networks of its clients, although the team did not confirm that intrusions occurred within those specific client networks.
Malware Deployment and Tradecraft
Unit 42 identified the deployment of Peerstitch, a previously undocumented ARM64 malware implant, which attackers installed by exploiting a separate FortiOS privilege-escalation vulnerability, CVE-2025-61624. This exploit involved an auto-script path traversal technique that facilitated the installation of the novel malware on the compromised firewalls. The threat actors, tracked as CL-STA-0954, demonstrated sophisticated tradecraft that overlaps with intrusions attributed to suspected nation-state actors.
Peerstitch is designed to remain undetected by operating entirely in memory. The malware leaves no persistent binary on disk, opens no listening ports, and initiates no outbound network connections. Instead, it hijacks legitimate processes on the compromised firewalls to conceal its activity and bypass conventional security detection mechanisms. This stealthy behavior makes the implant difficult to identify using standard file-based scanning tools.
Command and Control Channels
The attackers established a command-and-control channel through the Apache module on the FortiGate devices. By impersonating the management platform, the threat actors were able to retrieve configurations from additional firewalls beyond the initial scope of the compromise. This technique allowed them to maintain long-term access to the targeted environment and expand their foothold within the network.
Unit 42 noted that the compromise of centralized network management systems poses significant risks because stolen credentials and cryptographic trust material can enable access beyond the initially compromised appliance. The ability to impersonate the management platform allowed the attackers to move laterally and gather intelligence from multiple devices without raising immediate alarms.
What should you do?
Organizations should review their FortiManager and FortiGate configurations for signs of unauthorized access or unexpected changes. Security teams should monitor for unusual process behavior on firewall devices, as Peerstitch uses legitimate processes to hide. It is critical to ensure that management appliances are isolated and that credentials are rotated regularly to prevent lateral movement.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: FortiOS
- Audit FortiManager logs for unauthorized configuration exports or credential theft attempts, especially those originating from unexpected sources.
- Monitor FortiGate devices for anomalous process execution that does not correlate with standard system tasks or known applications.
- Verify the integrity of cryptographic material and certificates used for trust relationships between management consoles and managed firewalls.
- Implement network segmentation to limit the blast radius if a centralized management appliance is compromised, preventing easy lateral movement.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What vulnerability allowed the initial compromise of the FortiManager?
Attackers exploited CVE-2024-47575, a vulnerability in FortiManager, to steal configurations and credentials associated with managed FortiGate firewalls.
How does Peerstitch malware evade detection?
Peerstitch operates entirely in memory, leaves no files on disk, opens no ports, and uses legitimate processes to conceal its activity.
Was there any confirmation of breaches in client networks?
Unit 42 stated that while the stolen information exposed client networks, the investigation did not confirm intrusions into those specific client environments.
