HIGH Threat Intel #Ransomware #Zero-Day #Credential Theft

PEERSTITCH Malware Deployed via FortiManager and FortiOS Exploits

2026-11-01 20:08 UTC 3 min read Runtime Rebel Intel

Primary source: unit42.paloaltonetworks.com

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

A telecommunications organization suffered a multi-stage intrusion resulting in the exfiltration of sensitive configuration and credential data for over 500 managed firewalls.
The attackers targeted a centralized FortiManager appliance and downstream FortiGate firewalls using unauthenticated remote code execution and path traversal vulnerabilities.
Defenders must immediately audit FortiManager logs for unauthorized device registrations, rotate exposed credentials, and apply official vendor patches.

Overview of the CL-STA-0954 Intrusion Campaign

In September 2024, security researchers investigated a sophisticated multi-stage network intrusion targeting a telecommunications managed service provider. Tracked as cluster CL-STA-0954 (also known as UNC5820), the campaign leveraged critical vulnerabilities in centralized management infrastructure to gain deep visibility and control over perimeter devices. According to Unit 42, the threat actors exhibited advanced tradecraft, utilizing memory-resident malware and abusing administrative protocols to evade conventional security monitoring.

The initial breach occurred when the attackers targeted a centralized FortiManager appliance. By exploiting CVE-2024-47575, an unauthenticated remote code execution vulnerability in the FMG-Access management channel, the threat actors registered a rogue Virtual FortiGate appliance. This maneuver allowed them to exfiltrate an archive containing running system configurations, cryptographic keys, and database files pertaining to more than 500 managed firewalls.

Technical Analysis of PEERSTITCH Malware

Armed with stolen configuration data containing reversibly encrypted credentials, the attackers brute-forced administrative passwords and established unauthorized SSL/VPN sessions. This granted them authenticated access to internal management segments. To escalate privileges and maintain stealth, the actors abused CVE-2025-61624, a path traversal vulnerability residing in the FortiOS CLI system.auto-script engine.

How Attackers Exploit CVE-2025-61624 for Root Access

Normally, even high-privileged administrators operate within a restricted command-line interface without direct file system access. However, CVE-2025-61624 allows an authenticated administrator to supply unsanitized traversal sequences—such as ../../../../setup—within auto-script object names. This places script bodies outside intended directories and executes them with root privileges.

This flaw facilitated the deployment of PEERSTITCH, a novel, memory-resident ARM64 malware written in C and statically linked against glibc. PEERSTITCH exhibits several stealth characteristics:

No Disk Persistence: The malware operates entirely within process memory as a one-shot patching injector.
No Open Ports: It does not bind to listening ports or initiate outbound network connections.
Traffic Mimicry: It communicates entirely through traffic generated by legitimate processes on the infected host, bypassing standard endpoint detection mechanisms.

Mitigation and Remediation Steps

Defenders managing Fortinet environments must prioritize immediate hardening and patching procedures to prevent similar intrusion chains:

Apply Vendor Patches: Update FortiManager and FortiOS to the latest supported versions that remediate CVE-2024-47575 and CVE-2025-61624.
Audit Device Registrations: Review central management logs for unauthorized or unexpected FortiGate device registrations and rogue serial numbers.
Credential Rotation: Assume that any credentials present in exfiltrated configuration files have been compromised. Immediately rotate all administrative passwords, API keys, and pre-shared keys associated with managed firewalls.
Monitor Management Interfaces: Restrict access to the FMG-Access management channel (TCP port 541) to trusted internal management networks only.

#Ransomware #Zero-Day #Credential Theft

X/Twitter LinkedIn Reddit HN

← Back to Articles