PEERSTITCH FortiGate Implant: Attackers Went Through FortiManager and Took Data on 500+ Firewalls

🌐 This is the English edition of an article first published in Persian: بدافزار PEERSTITCH در فایروال FortiGate؛ نفوذ از FortiManager و اطلاعات بیش از ۵۰۰ فایروال در دست مهاجمان

On October 14, 2026, Palo Alto Networks Unit 42 published a report showing how a central management console can become the front door to every firewall in a network. Attackers used an old flaw in FortiManager to break into a telecommunications managed service provider, took the configurations, credentials and trust material of more than 500 FortiGate firewalls, and then used CVE-2025-61624 in FortiOS to plant a new implant called PEERSTITCH directly in firewall memory. Two days later, CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog.

🚨 Two flaws in one chain

• Initial access — CVE-2024-47575 (FortiJump): a critical FortiManager flaw rated 9.8 that lets an unauthenticated attacker run commands over the FGFM channel on TCP 541. It has been patched since October 2024.
• Getting root — CVE-2025-61624: a path traversal in the FortiOS CLI auto-script engine; an administrator who is logged in can write files outside the allowed path with root privileges. Fortinet published it in advisory FG-IR-26-122 (April 14, 2026) with a score of 6.0.
• CISA: added CVE-2025-61624 to KEV on October 16, 2026 and gave U.S. federal agencies until October 19 to fix it.
• Threat actor: Unit 42 tracks the activity as CL-STA-0954 (overlapping with UNC5820) and says parts of the post-exploitation behavior match intrusions attributed to state-backed groups.

Don’t let the medium score of CVE-2025-61624 mislead you: in this chain it is the bridge that takes the attacker from the restricted admin interface to the firewall’s underlying operating system.

🔍 What the attackers did, step by step

• Registered a rogue virtual FortiGate named “localhost” with FortiManager, without credentials.
• Within minutes, pulled an archive with configurations, databases, the serial number and IP inventory, topology, stored passwords and trust material for every managed firewall.
• Cracked the reversibly encrypted passwords and opened SSL VPN sessions into internal management segments from external infrastructure.
• Pushed traffic sniffer configurations to downstream firewalls (cleartext HTTP, RADIUS, LDAP and TFTP).
• Used CVE-2025-61624 to write the PEERSTITCH loader as root.
• Impersonated FortiManager over FGFM to pull configurations from other firewalls.
• Abused the ACME certificate renewal flow in Apache’s mod_md module to build a persistent reverse shell.
• Killed the logging daemons, cleared crash logs, and deleted rogue admin accounts and scripts after use.

🔬 Why PEERSTITCH is hard to see

PEERSTITCH is an ARM64 program written in C that uses ptrace to inject into two FortiOS processes: miglogd (logging) and iked (IPsec VPN). It deletes itself after running, opens no ports and makes no outbound connections. When traffic seen by the logging process carries two specific markers, a session tag is written into the VPN process’s memory, and the tagged session takes a path that bypasses FortiOS security checks. Because nothing stays on disk, Fortinet’s Integrity Checker, which only examines files, does not detect it.

🛠️ Immediate actions for firewall administrators

• Upgrade FortiOS: 7.6.0 through 7.6.4 to 7.6.5, and 7.4.0 through 7.4.9 to 7.4.10 or later; all 7.2, 7.0 and 6.4 releases are affected and must migrate to a fixed branch.
• Other products: FortiProxy to 7.6.5 or 7.4.12, FortiSwitchManager to 7.2.8 or 7.0.7, and FortiPAM 1.7.0 to 1.7.1 (branches 1.0 through 1.6 must migrate).
• FortiManager: if FortiJump is still unpatched, fix it today and keep port 541 open only to your own firewalls. Check the device list for unknown devices or one named “localhost”.
• Patching is not enough: if FortiManager was exposed, rotate every password, certificate and FGFM trust material on all managed devices; stolen keys stay valid until they are replaced.
• Hunt for indicators: auto-script objects containing ../, Signal 11 crashes of miglogd, iked or syslogd in diagnose debug crashlog read, unknown sniffer settings, and new admin accounts or VPN groups. For memory hunting, use the indicators and the YARA rule in the Unit 42 report.
• Keep logs off the device: the attackers wiped logs on the firewall itself; forward firewall and VPN logs to a central system in real time.

🧭 The lesson: the management console holds the keys to every firewall

When one central console holds the configuration and passwords of hundreds of firewalls, compromising it means compromising all of them. Management interfaces belong on a separate network, reachable only from known sources. Organizations that keep centralized firewall management off the internet, store logs off the device in a security event monitoring platform, require multi-factor authentication for administrator logins, and track edge device versions with continuous vulnerability monitoring give a chain like this far less room. If you need advice on upgrading or replacing an enterprise firewall or reviewing your network management architecture, get in touch.

— Kazem Mortazavi, independent network-security consultant