# PEERSTITCH Malware Deployed via FortiManager and FortiOS Exploits

> Discover how attackers used CVE-2024-47575 and PEERSTITCH malware to target telecommunications infrastructure in a sophisticated intrusion.

- Published: 2026-11-01T20:08:19.000Z
- Severity: high
- Category: Threat Intel
- Tags: Ransomware, Zero-Day, Credential Theft, PEERSTITCH, CVE-2024-47575
- CVEs: CVE-2024-47575 (CVSS 9.8), CVE-2025-61624 (CVSS 8.8)
- Author: Runtime Rebel Intel
- Primary source: https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
- Canonical: https://runtimerebel.com/blog/peerstitch-malware-deployed-via-fortimanager-and-fortios-exploits

## Key points

- A telecommunications organization suffered a multi-stage intrusion resulting in the exfiltration of sensitive configuration and credential data for over 500 managed firewalls.
- The attackers targeted a centralized FortiManager appliance and downstream FortiGate firewalls using unauthenticated remote code execution and path traversal vulnerabilities.
- Defenders must immediately audit FortiManager logs for unauthorized device registrations, rotate exposed credentials, and apply official vendor patches.

## Overview of the CL-STA-0954 Intrusion Campaign

In September 2024, security researchers investigated a sophisticated multi-stage network intrusion targeting a telecommunications managed service provider. Tracked as cluster CL-STA-0954 (also known as UNC5820), the campaign leveraged critical vulnerabilities in centralized management infrastructure to gain deep visibility and control over perimeter devices. According to [Unit 42](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/), the threat actors exhibited advanced tradecraft, utilizing memory-resident [malware](/glossary#malware) and abusing administrative protocols to evade conventional security monitoring.

The initial breach occurred when the attackers targeted a centralized FortiManager appliance. By exploiting [CVE-2024-47575](/cve/cve-2024-47575), an unauthenticated remote code execution [vulnerability](/glossary#vulnerability) in the FMG-Access management channel, the threat actors registered a rogue Virtual FortiGate appliance. This maneuver allowed them to exfiltrate an archive containing running system configurations, cryptographic keys, and database files pertaining to more than 500 managed firewalls.

## Technical Analysis of PEERSTITCH Malware

Armed with stolen configuration data containing reversibly encrypted credentials, the attackers brute-forced administrative passwords and established unauthorized SSL/[VPN](/glossary#vpn) sessions. This granted them authenticated access to internal management segments. To escalate privileges and maintain stealth, the actors abused [CVE-2025-61624](/cve/cve-2025-61624), a path traversal vulnerability residing in the FortiOS CLI system.auto-script engine.

### How Attackers [Exploit](/glossary#exploit) [CVE](/glossary#cve)-2025-61624 for Root Access

Normally, even high-privileged administrators operate within a restricted command-line interface without direct file system access. However, CVE-2025-61624 allows an authenticated administrator to supply unsanitized traversal sequences—such as `../../../../setup`—within auto-script object names. This places script bodies outside intended directories and executes them with root privileges.

This flaw facilitated the deployment of **PEERSTITCH**, a novel, memory-resident ARM64 malware written in C and statically linked against glibc. PEERSTITCH exhibits several stealth characteristics:

* **No Disk [Persistence](/glossary#persistence):** The malware operates entirely within process memory as a one-shot patching injector.
* **No Open Ports:** It does not bind to listening ports or initiate outbound network connections.
* **Traffic Mimicry:** It communicates entirely through traffic generated by legitimate processes on the infected host, bypassing standard [endpoint](/glossary#endpoint) detection mechanisms.

## Mitigation and Remediation Steps

Defenders managing Fortinet environments must prioritize immediate [hardening](/glossary#hardening) and patching procedures to prevent similar intrusion chains:

* **Apply Vendor Patches:** Update FortiManager and FortiOS to the latest supported versions that remediate CVE-2024-47575 and CVE-2025-61624.
* **Audit Device Registrations:** Review central management logs for unauthorized or unexpected FortiGate device registrations and rogue serial numbers.
* **Credential Rotation:** Assume that any credentials present in exfiltrated configuration files have been compromised. Immediately rotate all administrative passwords, [API](/glossary#api) keys, and pre-shared keys associated with managed firewalls.
* **Monitor Management Interfaces:** Restrict access to the FMG-Access management channel (TCP port 541) to trusted internal management networks only.

**Related:** [39 Methods Compromise Passkey Authentication: Threat Analysis](/blog/39-methods-compromise-passkey-authentication-threat-analysis), [Browser Attacks and EDR Blind Spots: Mitigating SaaS Threats](/blog/browser-attacks-and-edr-blind-spots-mitigating-saas-threats)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/peerstitch-malware-deployed-via-fortimanager-and-fortios-exploits