Unit 42 Links PEERSTITCH Implant to FortiManager Breach Affecting 500+ Firewalls
Researchers trace the deployment of a memory-resident malware implant to a September 2024 intrusion that exposed configurations for hundreds of managed devices.
Key points
- Attackers exploited CVE-2024-47575 in a FortiManager appliance to steal sensitive configuration archives.
- Stolen data included credentials and network maps for more than 500 managed FortiGate firewalls.
- The group deployed PEERSTITCH malware and pushed unauthorized packet-capture rules to monitor traffic.
Unit 42 researchers identified a multi-stage intrusion involving the PEERSTITCH memory-resident implant, which originated from a compromise of a telecommunications managed service provider’s FortiManager appliance. According to Cyber Security News, the attackers exploited vulnerabilities in Fortinet’s centralized management systems to gain initial access and subsequently deployed the stealthy malware within FortiGate processes.
The intrusion began in September 2024 when threat actors tracked as CL-STA-0954, also known as UNC5820, targeted the management platform. Cyber Security News reported that these attackers exploited CVE-2024-47575, known as FortiJump, to breach the system. This flaw allowed unauthenticated remote attackers to send crafted requests through the device’s management channel, enabling them to execute arbitrary commands on the appliance.
Technical Operation and Data Exfiltration
Unit 42 analysts detailed how the attackers registered a rogue device on the compromised FortiManager to create and exfiltrate a configuration archive. This stolen data provided a comprehensive map of the managed environment, including device serial numbers, public IP addresses, network routes, and firewall rules. The archive also contained cryptographic trust material and encrypted administrative and VPN credentials used to establish trust between the manager and its managed devices.
Researchers were able to recover plaintext administrative and VPN passwords from the stolen configuration files. While the exposure linked sensitive data to more than 500 managed FortiGate firewalls, Unit 42 stated that this did not confirm that the clients’ individual firewalls were compromised at the time of the breach. The presence of valid credentials, however, significantly lowered the barrier for further lateral movement within the network.
Malware Deployment and Surveillance
After a period of inactivity, the attackers leveraged the compromised management platform to push unauthorized packet-capture settings to selected managed firewalls. These rules monitored unencrypted HTTP traffic and specific services, including remote administration and network discovery protocols. Cyber Security News reported that researchers also observed captures aimed at TFTP, RADIUS, and LDAP traffic, which could reveal files, authentication data, and directory activity.
Using the recovered credentials, the threat actors opened unauthorized FortiGate VPN sessions to reach internal network-management areas. The PEERSTITCH implant, identified during this investigation, runs inside FortiGate processes to maintain persistence. Unit 42’s technical report describes the operation as moving from initial management compromise to credential use, network monitoring, and finally malware deployment.
What should you do?
Organizations using Fortinet management appliances should audit their FortiManager logs for unauthorized device registrations and command executions. Administrators should verify that all managed firewalls are running the latest firmware versions that address known vulnerabilities like CVE-2024-47575. Security teams should also review active packet-capture rules on their firewalls to ensure they are authorized and necessary.
What to do and how to stay safe: Fortinet
- Audit FortiManager logs for unauthorized device registrations or unusual command executions that could indicate a breach.
- Review active packet-capture configurations on managed firewalls to detect unauthorized monitoring of internal traffic.
- Rotate administrative and VPN credentials for all managed devices if configuration archives have been potentially exposed.
- Verify that all FortiGate and FortiManager appliances are patched against known vulnerabilities, including CVE-2024-47575.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What vulnerability did the attackers exploit to gain initial access?
The attackers exploited CVE-2024-47575, also known as FortiJump, which allows unauthenticated remote command execution via the management channel.
How many firewalls were potentially affected by the data exposure?
The stolen configurations linked to more than 500 managed FortiGate firewalls, though researchers did not confirm all were compromised.
What is PEERSTITCH and how does it operate?
PEERSTITCH is a stealthy malware implant that runs inside FortiGate processes, allowing attackers to maintain persistence and monitor network traffic.
