PEERSTITCH: a memory-resident FortiGate implant installed through the FortiOS CLI path traversal CVE-2025-61624, which Fortinet lists as exploited and leaves unfixed on FortiOS 7.2, 7.0 and 6.4, after a FortiManager compromise exposed the configurations of 500+ firewalls

Unit 42 investigated a September 2024 intrusion at a telecommunications organization, tracked as cluster CL-STA-0954, that began with CVE-2024-47575 against a centralized FortiManager appliance: the attackers registered a rogue virtual FortiGate, then exfiltrated an archive with the running configurations, cryptographic material and database files of more than 500 managed FortiGate firewalls (Unit 42, 2026-10-14). Unit 42 recovered the configurations' reversible-ciphertext credentials by brute force; the attackers later logged in over SSL VPN with legitimate credentials and pushed packet-capture settings to downstream firewalls (Unit 42, 2026-10-14).

For root they used CVE-2025-61624, a path traversal in the FortiOS CLI system.auto-script engine that lets an authenticated administrative account read and write arbitrary files as root (Unit 42, 2026-10-14). That installed PEERSTITCH, an ARM64 injector that attaches with ptrace to the logging daemon miglogd and the IPsec daemon iked, allocates a 16 KB read-write-execute region, NOP-patches three fixed offsets and links the daemons through /proc memory so that tagged VPN sessions skip default FortiOS validation; it leaves no persistent binary on disk, opens no listening port and makes no outbound connection of its own (Unit 42, 2026-10-14). Command and control ran through the firewall's own Apache mod_md ACME module, whose DNS-01 challenge handler executes Node.js with parameters from an attacker-run ACME server and so opens a reverse shell (Unit 42, 2026-10-14).

Fortinet's advisory FG-IR-26-122 of 2026-04-14 covers the CLI path traversal in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, lists it as known exploited, and for FortiOS gives fixes only in 7.6.5 and 7.4.10, telling users of 7.2, 7.0 and 6.4 to migrate to a fixed release (Fortinet, 2026-04-14).

Triage: legitimate FortiManager work also creates and deletes auto-scripts and adds devices; the report's signals are ../ in an auto-script name, a device registered from outside the management network, and accounts that match no administrator or tenant the organization created.