PEERSTITCH: How Attackers Weaponized FortiOS Internals to Build an Invisible VPN Backdoor
Executive Summary
In September 2024, a suspected advanced persistent threat actor tracked as CL-STA-0954 (UNC5820) compromised a telecommunications managed service provider by chaining two Fortinet vulnerabilities. Initial access was gained via CVE-2024-47575 (FortiJump) targeting FortiManager, enabling exfiltration of configurations, private keys, and metadata for over 500 managed FortiGate firewalls. Attackers then exploited CVE-2025-61624, a FortiOS path traversal flaw, to deploy PEERSTITCH—a memory-resident ARM64 implant that injects hooks into legitimate daemons (miglogd and iked) to create a covert inter-process communication bridge, effectively bypassing VPN session security checks without leaving disk artifacts.
This incident signals an accelerating trend of state-linked actors weaponizing centralized network management platforms to compromise downstream infrastructure at scale. The combined use of living-off-the-land injection techniques, WebAssembly payloads, and forensic artifact removal represents a maturation of edge-device malware tradecraft that outpaces conventional endpoint and network detection approaches.
Why This Matters Now
CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on October 16, 2026, with a federal remediation deadline of October 19, 2026. Organizations relying on FortiOS-managed perimeter infrastructure—particularly telecom and managed service providers—face active exploitation risk. The PEERSTITCH implant's ability to intercept and manipulate VPN sessions without network-visible indicators makes conventional detection inadequate, requiring immediate patching, VPN session integrity validation, and zero-trust segmentation to limit blast radius.
Attack Path Analysis
The threat actor (CL-STA-0954/UNC5820) gained initial access by exploiting the critical FortiManager zero-day CVE-2024-47575 (FortiJump), exfiltrating configuration archives containing credentials, private keys, and topology data for over 500 managed FortiGate firewalls. Using stolen cryptographic material, the actor escalated privileges across managed devices, established unauthorized SSL/VPN sessions, and moved laterally across downstream client and internal networks by impersonating the FortiManager platform. Persistence and command-and-control were achieved through a memory-resident implant (PEERSTITCH) injected into core FortiOS daemons via CVE-2025-61624, supplemented by an Apache mod_md-based SSH reverse shell, while forensic artifacts were systematically destroyed to hinder detection.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
The attacker exploited CVE-2024-47575 (FortiJump), a critical unauthenticated remote code execution flaw in FortiManager, to gain initial foothold. This allowed unauthorized access to the centralized management appliance without valid credentials, exposing the entire downstream managed firewall estate. The Cloud Native Security Fabric (CNSF) with inline IPS (Suricata) carrying CVE-specific signatures could have detected and blocked the exploit attempt at the network perimeter before the appliance was compromised.
Related CVEs
CVE-2024-47575
CVSS 9.8A missing authentication vulnerability in the FortiManager fgfmd daemon allows a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted requests, enabling full appliance compromise and downstream managed device access.
Affected Products:
Fortinet FortiManager – < 7.0.13, < 7.2.8, < 7.4.5, < 7.6.1
Exploit Status:
exploited in the wildCVE-2025-61624
CVSS 6.5A path traversal vulnerability in the FortiOS command line interpreter allows a privileged attacker to perform arbitrary file write or delete operations via specially crafted arguments to existing CLI commands, enabling privilege escalation and deployment of malicious payloads such as the PEERSTITCH implant.
Affected Products:
Fortinet FortiOS – < patched April 2026
Fortinet FortiPAM – < patched April 2026
Fortinet FortiProxy – < patched April 2026
Fortinet FortiSwitchManager – < patched April 2026
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Exploitation for Privilege Escalation
Process Injection
Obfuscated Files or Information
Unsecured Credentials
Exfiltration Over C2 Channel
Impair Defenses
Remote Services: SSH
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Malicious Code Protection / Software Integrity / Process Isolation
Control ID: SI-3, SI-7, SC-39
PCI DSS 4.0 – Vulnerability Management / Audit Log Monitoring / Network Intrusion Detection
Control ID: Requirement 6.3.3, 10.7, 11.5
NYDFS 23 NYCRR 500 – Cybersecurity Policy / Access Privileges / Training and Monitoring
Control ID: 500.3, 500.7, 500.14
DORA (EU 2022/2554) – ICT Security / Patch and Vulnerability Management / ICT Third-Party Risk
Control ID: Article 9, Article 10, Article 13
NIS2 Directive (EU 2022/2555) – Risk Management / Incident Handling / Supply Chain Security and Reporting
Control ID: Article 21(2)(a)(b)(e), Article 23
CISA Zero Trust Maturity Model 2.0 – Network Micro-Segmentation / Workload Runtime Integrity Monitoring
Control ID: Network Pillar – Micro-Segmentation; Application Workload Pillar – Runtime Integrity
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Telecommunications
PEERSTITCH's memory-resident APT directly targeted a telecom managed service provider, enabling FortiOS VPN session hijacking, credential theft, and lateral movement across 500+ downstream client firewall infrastructures.
Information Technology/IT
Exploitation of CVE-2025-61624 and FortiJump against FortiManager appliances threatens IT managed service providers, exposing centralized edge management ecosystems to covert C2, privilege escalation, and zero-trust policy bypass.
Computer/Network Security
Memory-resident implant bypassing FortiOS VPN security validations undermines network security vendors and MSSPs, with stolen cryptographic material and private keys collapsing encrypted traffic and segmentation compliance controls.
Government Administration
CISA KEV mandate requiring federal patch by October 19, 2026 signals direct government exposure; stolen network topology, routing tables, and SSL/VPN credentials risk critical infrastructure lateral movement and exfiltration.
Sources
- PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessionshttps://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.htmlVerified
- Fortinet PSIRT Advisory FG-IR-24-423: FortiManager Missing Authentication Vulnerability (CVE-2024-47575)https://www.fortiguard.com/psirt/FG-IR-24-423Verified
- NVD Detail: CVE-2024-47575https://nvd.nist.gov/vuln/detail/CVE-2024-47575Verified
- CISA KEV Catalog - Known Exploited Vulnerabilitieshttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- CISA Alert: CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 16, 2026)https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalogVerified
- Unit 42 Research: FortiManager CVE-2024-47575 and PEERSTITCH Malware Analysishttps://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/Verified
- The Hacker News: Fortinet Warns of Critical FortiManager Flaw (FortiJump)https://thehackernews.com/2024/10/fortinet-warns-of-critical.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
This incident demonstrates how a centralized management platform compromise can cascade across hundreds of downstream firewall estates — precisely the scenario Aviatrix Zero Trust CNSF is designed to constrain. By enforcing inline inspection, identity-scoped segmentation, east-west policy controls, and egress filtering, CNSF would likely have reduced the attacker's reachability across managed networks and limited the blast radius of stolen credential material before widespread lateral movement occurred.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline IPS carrying CVE-specific signatures for CVE-2024-47575 would likely have detected and flagged the unauthenticated exploit attempt targeting the FortiManager appliance, potentially constraining the attacker's ability to complete initial access before configuration archives were reached.
Control: Zero Trust Segmentation
Mitigation: Zero Trust Segmentation enforcing identity-based, least-privilege access policies between management plane and operational zones would likely have constrained how far stolen credential material could be exercised, reducing the attacker's ability to impersonate privileged administrators across managed devices.
Control: East-West Traffic Security
Mitigation: East-west enforcement monitoring workload-to-workload and service-to-service traffic flows would likely have flagged the anomalous inter-device management communications originating from unexpected sources, reducing the attacker's ability to pivot freely across management and operational network zones.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic observability and behavioral baseline monitoring would likely have flagged the aberrant SSH reverse shell originating from a firewall process, and could have surfaced the anomalous TCP port 8550 activity and link-local addressing patterns as deviations from expected daemon behavior, reducing attacker dwell time.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement with FQDN and IP-based outbound filtering would likely have blocked the bulk data transfer to the unauthorized external destination at 23.240.77[.]233:8085, reducing the attacker's ability to successfully complete exfiltration of the full configuration archive and cryptographic material.
Had earlier CNSF controls constrained initial reachability, lateral movement, and exfiltration, the attacker's persistent foothold would likely have been limited to a narrower set of devices rather than spanning the full 500-plus managed firewall estate, meaningfully reducing the scope of downstream client exposure and the attacker's ability to conduct sustained VPN interception and configuration manipulation at scale.
Impact at a Glance
Affected Business Functions
- Managed Network Operations and VPN Infrastructure
- Telecommunications Service Delivery and Client Network Management
- Centralized Firewall and Security Policy Administration
- Customer Data and Cryptographic Credential Integrity
Estimated downtime: 21 days
Estimated loss: N/A
Exfiltration of running configuration files and management metadata for more than 500 managed FortiGate firewalls across internal and client networks, including: ciphertext administrative and SSL/VPN credentials, private cryptographic keys and public certificates, internal network topology maps and routing tables, FortiGate serial numbers with associated public IP addresses, and central management SQLite databases. The scope represents a full trust-chain compromise of a telecommunications managed service provider and its downstream enterprise clients, enabling persistent unauthorized VPN sessions, traffic interception, and lateral movement across client environments. Financial loss estimate is set to 0 as no confirmed figure has been publicly disclosed; however, the true financial and reputational exposure is expected to be extremely high given the scale of downstream customer network compromise.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Inline IPS (Suricata) with up-to-date CVE signatures at all network ingress points to detect and block exploitation of known FortiOS/FortiManager vulnerabilities such as CVE-2024-47575 and CVE-2025-61624 before initial compromise can occur.
- • Enforce Zero Trust Segmentation with identity-based, least-privilege policies between management plane components and operational firewall networks, preventing stolen credentials and trust material from being used to pivot across enrolled managed devices or impersonate centralized management platforms.
- • Implement East-West Traffic Security monitoring on all inter-appliance and service-to-service flows, establishing behavioral baselines that alert on anomalous management protocol usage, unexpected VPN session establishment patterns, and lateral movement across network segments.
- • Apply Egress Security and Policy Enforcement with strict FQDN and IP-based outbound filtering to block unauthorized data transfer to external destinations and intercept reverse shell callback traffic, preventing both bulk configuration exfiltration and C2 channel establishment through cloud firewall (ACF) controls.
- • Activate Multicloud Visibility and Control with centralized traffic observability and continuous anomaly detection across all hybrid and edge network components, ensuring that covert inter-process communication bridges, daemon memory injection artifacts, and logging disruption events are surfaced and trigger automated incident response workflows aligned with NIST.800-53.AU-6 and NIST.CSF.DE.CM-7.
