Unit 42 Links PEERSTITCH Implant to FortiManager Breach Affecting 500+ Firewalls

Palo Alto Networks Unit 42 researchers linked a new memory-resident malware implant to a prolonged intrusion targeting a telecommunications managed service provider. The investigation, published on October 14, tracks the threat actor activity as CL-STA-0954, also known as UNC5820. This analysis expands on earlier findings regarding the compromise of Fortinet management infrastructure.

The attackers initially gained access by exploiting CVE-2024-47575, a missing-authentication vulnerability commonly referred to as FortiJump. They abused the management channel on TCP port 541 to register a rogue virtual appliance named localhost. Using serial number FMG-VMTM23017412, the intruders subsequently exfiltrated a configuration archive containing sensitive operational data.

Technical Execution and Persistence

The stolen archive included running configurations, administrative databases, network topology details, and encrypted credentials. Unit 42 confirmed that administrative and SSL/VPN passwords were recoverable from these stolen configurations. Attackers then used these legitimate credentials to establish unauthorized VPN sessions from infrastructure including IP addresses 23.240.77[.]233 and 47.18.167[.]159.

To maintain persistence, the group deployed PEERSTITCH, an ARM64 implant designed to hide inside system memory. The malware hijacks legitimate FortiOS processes without leaving a persistent executable on disk. It opens no listening ports and initiates no outbound connections of its own, making detection through traditional network monitoring difficult.

Impact on Managed Infrastructure

Unit 42 stated that the intrusion began in September 2024 by exploiting a centralized FortiManager appliance. This initial breach exposed configurations and cryptographic material tied to more than 500 managed firewalls. Researchers did not investigate customer networks or confirm downstream customer compromises, focusing instead on the initial access and implant deployment.

Attackers pushed unauthorized packet-capture configurations to the managed firewalls to intercept HTTP traffic. These captures targeted services including TFTP, RADIUS, and LDAP, supporting credential interception and internal reconnaissance. This activity allowed the threat actors to monitor authentication attempts and gather further intelligence on the internal network structure.

What should you do?

Organizations should review FortiManager logs for unauthorized virtual appliance registrations or unusual management channel activity. Security teams should monitor for unexpected packet-capture configurations on managed firewalls, particularly those targeting authentication protocols. Verify that administrative credentials have not been compromised by checking for unauthorized VPN session establishments from unfamiliar IP addresses.

What to do and how to stay safe: Fortinet

• Audit FortiManager logs for rogue virtual appliance registrations and unauthorized management channel usage on TCP port 541.
• Inspect managed firewalls for unexpected packet-capture configurations targeting TFTP, RADIUS, or LDAP services.
• Monitor for unauthorized VPN sessions established using legitimate administrative credentials from unknown external IPs.
• Review FortiOS process lists for anomalies indicative of memory-resident implants hijacking system daemons.

Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is PEERSTITCH?

PEERSTITCH is a memory-resident ARM64 implant deployed against FortiGate firewalls that hijacks legitimate processes without leaving persistent files.

How did attackers gain initial access?

Attackers exploited CVE-2024-47575, a missing-authentication vulnerability in FortiManager, to register a rogue virtual appliance and exfiltrate configurations.

How many firewalls were affected?

The intrusion exposed configurations and cryptographic material tied to more than 500 managed firewalls connected to the compromised FortiManager appliance.