Full Report
We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware. The post Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant appeared first on Unit 42.
Analysis Summary
# Incident Report: Exploitation of FortiGate Firewalls via CVE-2024-47575 (PEERSTITCH)
## Executive Summary
Attackers exploited a critical vulnerability (CVE-2024-47575) in FortiManager/FortiGate systems to deploy a custom, memory-resident ARM64 malware dubbed PEERSTITCH. The campaign targeted over 500 firewalls globally, primarily for data exfiltration and maintaining stealthy persistence. The intrusion resulted in the theft of sensitive configuration files and device information across various sectors.
## Incident Details
- **Discovery Date:** October 2024 (Publicly disclosed by Unit 42)
- **Incident Date:** Activity identified starting as early as mid-2024
- **Affected Organization:** Multiple (500+ entities)
- **Sector:** Diversified (including Government, Critical Infrastructure, and Enterprise)
- **Geography:** Global (with significant hits in North America and Europe)
## Timeline of Events
### Initial Access
- **Date/Time:** Ongoing through late 2024
- **Vector:** Exploitation of CVE-2024-47575 (FortiManager Missing Authentication for Critical Function).
- **Details:** Attackers used specially crafted requests to the FortiGate fgfm daemon to gain unauthorized command execution.
### Lateral Movement
- **Details:** The primary goal was lateral movement from management consoles (FortiManager) to managed devices (FortiGate) using legitimate management protocols to deploy the implant.
### Data Exfiltration/Impact
- **Details:** Attackers targeted FortiGate configuration files, which contain hashed credentials, network topology, and VPN settings. PEERSTITCH served as a bridge for compressing and exfiltrating this data via encrypted tunnels.
### Detection & Response
- **Discovery:** Detected via anomalous activity in management logs and memory forensics on ARM64-based appliances.
- **Response:** Fortinet released patches and workarounds; Unit 42 published detailed behavioral analysis to facilitate hunting for the PEERSTITCH implant.
## Attack Methodology
- **Initial Access:** Exploitation of CVE-2024-47575 (FortiManager protocol vulnerability).
- **Persistence:** Memory-resident implant (PEERSTITCH). It does not survive a reboot but is often redeployed via the compromised manager.
- **Privilege Escalation:** Exploitation of the management daemon provided root-level access to the firewall's underlying Linux OS.
- **Defense Evasion:** Memory-only execution; use of custom XOR-encrypted communication; mimicking legitimate management traffic.
- **Credential Access:** Extraction of hashed passwords and secrets from `config` files.
- **Discovery:** Use of built-in FortiOS commands to map the network and managed device lists.
- **Lateral Movement:** Using FortiManager to push the implant to subordinate FortiGate devices.
- **Collection:** Automated gathering of device configuration and system logs.
- **Exfiltration:** Data is compressed and exfiltrated via the PEERSTITCH C2 channel using the `fgfm` protocol ports.
- **Impact:** Loss of sensitive network configurations and potential long-term unauthorized access.
## Impact Assessment
- **Financial:** High potential costs for remediation, forensic investigation, and password resets across hundreds of devices.
- **Data Breach:** High. Exposure of configuration files allows for follow-on attacks against VPNs and internal networks.
- **Operational:** Low direct downtime, as the malware is designed to be stealthy and non-disruptive to traffic flow.
- **Reputational:** Significant for organizations managing critical infrastructure via these appliances.
## Indicators of Compromise
- **Network Indicators:**
- Traffic to `45.32.180[.]7` on port 541 (defanged)
- Traffic to `154.213.187[.]8` (defanged)
- Unusual `fgfm` protocol traffic patterns.
- **File Indicators:**
- PEERSTITCH (ARM64 ELF) - Memory resident only.
- Files typically found in `/tmp/` or `/var/` during the exploitation phase (often deleted).
- **Behavioral Indicators:**
- Log entries showing unauthorized serial numbers connecting to FortiManager.
- Presence of unknown "provisioned" devices in the management console.
## Response Actions
- **Containment:** Immediately restrict access to the FortiManager interface (FGFM) to trusted IP addresses only.
- **Eradication:** Apply patches for CVE-2024-47575. Perform a hard reboot of all affected ARM64 appliances to clear memory-resident implants.
- **Recovery:** Rotate all credentials, pre-shared keys (PSKs), and secrets found in the firewall configuration files.
## Lessons Learned
- **Vulnerability Management:** Critical infrastructure edge devices are high-value targets; zero-day exploitation is a primary vector for state-sponsored or sophisticated actors.
- **Visibility Gap:** Traditional EDR often cannot be installed on network appliances, necessitating specialized logging and network traffic analysis.
- **Supply Chain/Management Risk:** Centralized management tools (like FortiManager) create a single point of failure that can compromise the entire fleet.
## Recommendations
- **Zero Trust:** Implement strict ACLs for all management interfaces, ensuring they are never exposed to the public internet.
- **Monitoring:** Enable and centralize logs for all management protocol activity (FGFM).
- **Integrity Checks:** Regularly perform system integrity checks and firmware verification provided by the vendor.
- **Incident Planning:** Develop specific playbooks for "Headless Device" compromise where standard antivirus tools are unavailable.