Full Report
Palo Alto Networks’ Unit 42 threat intelligence team uncovered a multistage cyber intrusion against a telecommunications managed service... The post Unit 42 traces Peerstitch malware deployment to FortiOS vulnerability exploited after FortiManager compromise appeared first on Industrial Cyber.
Analysis Summary
# Incident Report: FortiManager Compromise Leads to Peerstitch Malware Deployment Against a Telecom MSP
## Executive Summary
Attackers exploited the FortiManager vulnerability CVE-2024-47575 to compromise a telecommunications managed service provider in September 2024. They stole configurations, credentials, and cryptographic material for more than 500 managed FortiGate firewalls, then used that access to intercept traffic, establish unauthorized VPN sessions, and maintain long-term access. Unit 42 later found that the attackers deployed Peerstitch, a previously undocumented, memory-resident ARM64 implant, by exploiting a separate FortiOS vulnerability (CVE-2025-61624). The article does not describe the provider's containment or recovery actions.
## Incident Details
- **Discovery Date:** Reported by Unit 42 and published October 19, 2026. The exact date of internal detection is not disclosed in the available text.
- **Incident Date:** September 2024 (initial intrusion). The timing of the Peerstitch deployment is not stated.
- **Affected Organization:** Unnamed telecommunications managed service provider, along with its clients' networks (Unit 42 did not confirm intrusions into client networks).
- **Sector:** Telecommunications / managed security and network services
- **Geography:** Not disclosed in the available text
## Timeline of Events
### Initial Access
- **Date/Time:** September 2024
- **Vector:** Exploitation of a vulnerability in the provider's central FortiManager appliance (CVE-2024-47575). The flaw allowed an unauthenticated remote attacker to run arbitrary commands through the management channel.
- **Details:**
- The attackers registered a rogue virtual firewall device with the FortiManager instance from infrastructure they controlled, and later changed the source of that infrastructure.
- Immediately after registering the rogue device, they generated a configuration archive on the FortiManager and exfiltrated it shortly afterward.
- The archive contained the appliance's identifying details, its management relationships with every enrolled device, and complete running configurations for more than 500 managed firewalls across internal infrastructure and client networks.
### Lateral Movement
- The attackers used the compromised management appliance to map network topology and identify further targets.
- They impersonated the FortiManager platform to pull configurations from managed firewalls belonging to other hosts in the targeted network.
- Stolen credentials and cryptographic trust material allowed access beyond the initially compromised appliance.
### Data Exfiltration/Impact
- **Stolen data:** Device configurations, credentials, cryptographic material, network topology information, and management relationships for more than 500 FortiGate firewalls.
- **Operational impact:** Traffic interception, unauthorized VPN sessions, and deployed backdoors.
- **Persistence:** Long-term access to the target environment was maintained.
### Detection & Response
- **Discovery:** Unit 42 threat intelligence investigated the intrusion and published its findings, including the Peerstitch analysis. The article does not describe how the provider first detected the activity.
- **Response actions:** Not described in the available text (the article is truncated).
## Attack Methodology
- **Initial Access:** Unauthenticated remote exploitation of FortiManager (CVE-2024-47575) to execute arbitrary commands.
- **Persistence:** Rogue virtual firewall registered to FortiManager; backdoors deployed; Peerstitch implant on compromised FortiGate devices.
- **Privilege Escalation:** FortiOS auto-script path traversal (CVE-2025-61624), which enabled deployment of Peerstitch.
- **Defense Evasion:** Peerstitch is memory-resident, leaves no persistent binary on disk, opens no listening ports, and initiates no outbound connections. It communicates through traffic generated by legitimate processes on the infected host.
- **Credential Access:** Theft of credentials and cryptographic material stored in the FortiManager configuration archive.
- **Discovery:** Collection of network topology and management relationships from the FortiManager.
- **Lateral Movement:** Impersonation of the FortiManager platform to retrieve configurations from other managed firewalls; reuse of stolen trust material.
- **Collection:** Interception of network traffic; retrieval of running configurations.
- **Exfiltration:** Configuration archive generated and exfiltrated shortly after the rogue device was registered.
- **Impact:** Unauthorized VPN sessions, traffic interception, and backdoors. Unit 42 noted that some post-exploitation activity overlaps with intrusions attributed to suspected nation-state actors. The activity cluster is tracked as CL-STA-0954.
## Impact Assessment
- **Financial:** Not disclosed
- **Data Breach:** Configurations, credentials, and cryptographic material for more than 500 managed FortiGate firewalls, plus FortiManager identifying and management-relationship data. Exposure extended to the provider's infrastructure and, potentially, client networks.
- **Operational:** Interception of network traffic and unauthorized VPN access create risk to availability and integrity. Specific business disruption is not described.
- **Reputational:** Not discussed in the available text. The compromise of a managed service provider puts downstream clients at risk.
## Indicators of Compromise
- **Network indicators:** Not provided in the available text. Attacker-controlled infrastructure used to register the rogue device is referenced but not listed.
- **File indicators:** No persistent binary on disk (Peerstitch is memory-resident). Target platform is ARM64.
- **Behavioral indicators:**
- Unexpected registration of new virtual firewall devices in FortiManager
- Configuration archive generation followed shortly by outbound data transfer
- FortiManager-style configuration requests originating from unexpected hosts
- Command-and-control traffic routed through the FortiGate Apache module
- Unauthorized or unexpected VPN sessions
- Anomalous activity from legitimate processes on FortiGate devices
## Response Actions
- **Containment:** Not described in the available text.
- **Eradication:** Not described in the available text.
- **Recovery:** Not described in the available text.
## Lessons Learned
- Compromising a centralized management system can expose every device it manages. A single FortiManager compromise gave access to more than 500 firewalls.
- Stored configurations, credentials, and cryptographic trust material are high-value targets. Their theft can enable access long after the initial vector is closed.
- Memory-resident implants that use legitimate processes can evade conventional endpoint and network detection.
- Chained vulnerabilities (a management-plane flaw followed by a FortiOS privilege escalation) can be used to move from management systems to edge devices.
- The article indicates the Peerstitch deployment used a 2025 CVE, while the initial intrusion is dated September 2024. The attackers therefore appear to have maintained access for a considerable period. Organizations should verify this timeline against the full Unit 42 report.
## Recommendations
- **Patch promptly:** Apply fixes for CVE-2024-47575 (FortiManager) and CVE-2025-61624 (FortiOS). Treat management platforms as high-priority patch targets.
- **Restrict management access:** Limit FortiManager and similar management interfaces to dedicated administrative networks. Do not expose them to untrusted networks.
- **Audit device registrations:** Review FortiManager for unauthorized or unexpected device registrations and changes to device sources.
- **Monitor configuration exports:** Alert on configuration archive generation and unexpected outbound transfers from management systems.
- **Rotate secrets after exposure:** If a management system may have been compromised, rotate credentials, VPN pre-shared keys, certificates, and other cryptographic material on all managed devices.
- **Hunt for memory-resident implants:** Inspect FortiGate devices for anomalous processes, unexpected Apache module activity, and unauthorized ARM64 code execution. Traditional disk-based scanning may miss this activity.
- **Review VPN sessions:** Audit active and historical VPN sessions for unauthorized access.
- **Segment management and client networks:** Limit the blast radius of a management-plane compromise by isolating management relationships from client environments.
- **Follow vendor and threat intelligence guidance:** Consult the full Unit 42 report for indicators of compromise and detection content for CL-STA-0954 and Peerstitch.