Fortinet FortiGate Firewalls Hacked with PEERSTITCH Malware via Exploited Vulnerabilities

Key Takeaways

• Attackers compromised a telecommunications managed service provider by exploiting two Fortinet vulnerabilities.
• The breach involved FortiManager and FortiGate devices, leading to the deployment of PEERSTITCH malware.
• PEERSTITCH is a highly evasive, memory-resident implant designed to bypass standard security checks.
• The compromise exposed sensitive configuration data for over 500 FortiGate firewalls, including credentials and cryptographic material.
• Organizations should immediately review FortiManager and FortiGate logs for indicators of compromise and apply recommended mitigations.

Cybersecurity researchers have uncovered a sophisticated attack against a telecommunications managed service provider (MSP) that leveraged vulnerabilities in Fortinet’s network management and firewall systems. The incident resulted in the deployment of PEERSTITCH, a highly stealthy malware implant designed to operate within legitimate FortiGate processes, making detection exceptionally difficult.

The campaign, tracked as CL-STA-0954 or UNC5820 by Analysts from Unit 42 identified PEERSTITCH, commenced in September 2024 with the initial compromise of a FortiManager appliance. This breach exposed critical configurations and sensitive data pertaining to more than 500 managed FortiGate firewalls. While this exposure did not definitively confirm the compromise of all client firewalls, it provided attackers with an extensive blueprint of the managed environment.

Initial Compromise and Data Exfiltration

The attackers exploited CVE-2024-47575, dubbed “FortiJump,” against the FortiManager system. This vulnerability allowed an unauthenticated remote attacker to execute commands by sending specially crafted requests through the device’s management interface. Unit 42’s investigation revealed that the threat actors registered a rogue device, created an archive of sensitive data, and subsequently exfiltrated it.

The stolen archive contained a trove of valuable information, including firewall configurations, detailed network schematics, administrative credentials, and cryptographic trust material. This data provided the attackers with an in-depth understanding of the managed environment, including device serial numbers, public IP addresses, network routes, firewall rules, and management relationships. Crucially, researchers from Unit 42 were able to recover administrative and VPN passwords from these encrypted configuration files, highlighting the severity of the data breach.

Following the initial data exfiltration and a period of dormancy, the attackers utilized the compromised FortiManager platform to push unauthorized packet-capture settings to a subset of the managed FortiGate firewalls. These rules were configured to monitor unencrypted HTTP traffic and specific services, including remote administration and network discovery protocols. Further observations indicated captures targeting TFTP, RADIUS, and LDAP traffic, suggesting an intent to harvest files, authentication data, and directory activity.

PEERSTITCH Deployment and Evasion

With the recovered credentials, the attackers established unauthorized VPN sessions on FortiGate devices, gaining access to internal network-management zones. This demonstrated how a single compromise of a central management system could cascade, enabling attackers to extend their reach across interconnected devices using stolen trust material and device information.

The threat actors then exploited a second vulnerability, CVE-2025-61624, through FortiOS’s system.auto-script feature. This path traversal flaw allowed an authenticated administrator to write files outside their designated directory, with the script executing at root level. This critical access enabled the attackers to escalate privileges from a restricted administrative interface to full control over the firewall’s underlying operating system.

Leveraging the path traversal, the attackers deployed a loader onto selected devices via an auto-script object. This loader retrieved multiple components, including JavaScript and WebAssembly files, alongside a native ARM64 executable named lldprx. After a strategic delay, the deployment script launched lldprx, which then targeted two essential FortiOS processes: miglogd (responsible for logging) and iked (handling IKE and IPsec VPN functions).

The lldprx injector attached to both processes, creating a 16-kilobyte memory region with read, write, and execute permissions. It then injected its PEERSTITCH payload into this area and altered the execution paths within the legitimate daemons. PEERSTITCH subsequently used process memory to transfer session tags between miglogd and iked. When specific markers were detected in VPN traffic, the implant could divert execution through an alternate code path, effectively bypassing standard FortiOS security checks.

This sophisticated design renders PEERSTITCH incredibly difficult to detect through routine security measures. The malware does not leave a persistent binary on disk, open its own listening port, or initiate outbound connections. Instead, it meticulously conceals its activities within legitimate system processes and their existing network traffic, making it a formidable adversary.

Secondary Command and Control and Anti-Forensics

Beyond the memory-resident implant, researchers also discovered that the attackers established a secondary command and control channel by abusing Apache’s mod_md module, typically used for automated certificate management. They modified the configuration to allow certificate-validation activities to execute commands via Node.js, establishing persistent callbacks to attacker infrastructure. This provided a redundant remote control mechanism.

To thwart forensic investigations, the attackers engaged in extensive anti-forensics measures. They halted logging services, cleared crash logs, deleted rogue accounts and auto-script objects, and replaced malicious Apache configuration files with innocuous-looking text. The lldprx injector itself was designed to self-delete its file and terminate the staging process before exiting, further obscuring its presence.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Patch Immediately: Ensure all FortiManager and FortiGate devices are updated with the latest security patches to address CVE-2024-47575 and CVE-2025-61624.
• Review Logs and Configurations: Scrutinize FortiManager and FortiGate logs for any unexpected device registrations, unfamiliar administrator accounts, suspicious VPN sessions, or auto-script entries containing path traversal strings (e.g., ../../).
• Validate Backups: Compare current firewall configurations against known-good backups to identify any unauthorized modifications.
• Assume Compromise for Stored Credentials: Treat all credentials, certificates, and trust material stored on a compromised management server as exposed and initiate a comprehensive credential reset and certificate revocation process.
• Perform Memory Forensics: For PEERSTITCH-specific hunting, examine the memory maps of miglogd and iked processes for anonymous 16-kilobyte regions with read, write, and execute permissions. Look for memory patches at specific offsets identified by Unit 42, cross-process writes to /proc/<pid>/mem, relevant daemon crashes, and suspicious auto-script objects.
• Monitor Network Traffic: Implement enhanced monitoring for unusual outbound connections, especially those related to ACME certificate management or Node.js execution from Fortinet devices.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.