--- schema: 1 kind: threat title: "PEERSTITCH: a memory-resident FortiGate implant installed through the FortiOS CLI path traversal CVE-2025-61624, which Fortinet lists as exploited and leaves unfixed on FortiOS 7.2, 7.0 and 6.4, after a FortiManager compromise exposed the configurations of 500+ firewalls" headline: "Unit 42: a memory-resident FortiGate implant rides an exploited FortiOS flaw that has no fix on 7.2, 7.0 and 6.4" summary: > Unit 42 describes a September 2024 intrusion at a telecommunications organization, tracked as CL-STA-0954 (UNC5820), that began with the FortiManager flaw CVE-2024-47575, exfiltrated the configurations and cryptographic material of more than 500 managed FortiGate firewalls, and later used the FortiOS CLI auto-script path traversal CVE-2025-61624 to install PEERSTITCH, an ARM64 implant that patches the logging and IPsec daemons in memory and leaves no persistent binary on disk. Fortinet's advisory FG-IR-26-122 of 2026-04-14 lists CVE-2025-61624 as known exploited and gives no fix for FortiOS 7.2, 7.0 and 6.4, only a move to a fixed release, so those branches stay exposed to an attacker who already holds a privileged administrator account. discovered_at: "2026-10-16T04:22:30Z" updated_at: null event_date: "2026-10-14" run_id: 2026-10-16T0256Z-intel priority: notable immediate_action: null tags: [espionage, vulnerabilities, actively-exploited, priv-esc, patch-available, no-patch] regions: [global] sectors: [telco] entities: ["actor:cl-sta-0954", "malware:peerstitch", "product:fortinet-fortios", "product:fortinet-fortimanager"] techniques: [T1190, T1068, T1055.008, T1040, T1078, T1133, T1552.001, T1059.007, T1685.006, T1070] affected_products: ["Fortinet FortiOS", "Fortinet FortiManager", "Fortinet FortiProxy", "Fortinet FortiPAM", "Fortinet FortiSwitchManager"] cves: - id: CVE-2025-61624 cvss: "6.0" epss: null type: path-traversal vector: zero-click auth: admin-required status: [exploited, patch-available, no-patch] affected: "FortiOS 7.6.0 to 7.6.4, 7.4.0 to 7.4.9 and all versions of 7.2, 7.0 and 6.4; FortiProxy 7.6.0 to 7.6.4, 7.4.0 to 7.4.11 and all of 7.2 and 7.0; FortiPAM 1.7.0 and all of 1.0 to 1.6; FortiSwitchManager 7.2.0 to 7.2.7 and 7.0.0 to 7.0.6" fixed: "FortiOS 7.6.5 and 7.4.10; FortiProxy 7.6.5 and 7.4.12; FortiPAM 1.7.1; FortiSwitchManager 7.2.8 and 7.0.7; no fix on FortiOS 7.2, 7.0 and 6.4, FortiProxy 7.2 and 7.0 or FortiPAM 1.0 to 1.6, where Fortinet says to migrate to a fixed release; virtual patch FG-VD-59270.0day in FMWP database update 25.120" sources: - url: "https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/" publisher: "Palo Alto Networks Unit 42" date: "2026-10-14" role: primary - url: "https://fortiguard.fortinet.com/psirt/FG-IR-26-122" publisher: "Fortinet PSIRT (FG-IR-26-122)" date: "2026-04-14" role: corroborating - url: "https://fortiguard.fortinet.com/psirt/FG-IR-24-423" publisher: "Fortinet PSIRT (FG-IR-24-423)" date: "2024-10-23" role: corroborating closed_sources: [] evidence: - quote: "PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections." publisher: "Palo Alto Networks Unit 42" source_url: "https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/" - quote: "The vulnerability allows an authenticated administrative account to read and write arbitrary files as root via path traversal in the FortiOS CLI system.auto-script engine." publisher: "Palo Alto Networks Unit 42" source_url: "https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/" - quote: "the attackers exfiltrated an archive containing running configurations, cryptographic material and database files containing information about more than 500 managed FortiGate firewalls" publisher: "Palo Alto Networks Unit 42" source_url: "https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/" - quote: "The cryptographic trust material governing the platform's relationship with every managed device leaves with the attacker and remains valid until it is rotated." publisher: "Palo Alto Networks Unit 42" source_url: "https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/" verification: single-source sourcing_note: > Unit 42 is the only observer of the 2024 intrusion; Fortinet's own advisory is the source for the affected and fixed versions and for its listing of CVE-2025-61624 as known exploited, and it gives no detail on who exploited it or when. The intrusion is from September 2024 and was published on 2026-10-14. confidence: high references: - 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed deep_dive: false deep_dive_category: null org_triage: null classification: reliability: B credibility: 2 watchlist_hit: false actions: [] updates: [] migrated_from: null --- Unit 42 investigated a September 2024 intrusion at a telecommunications organization, tracked as cluster CL-STA-0954, that began with CVE-2024-47575 against a centralized FortiManager appliance: the attackers registered a rogue virtual FortiGate, then exfiltrated an archive with the running configurations, cryptographic material and database files of more than 500 managed FortiGate firewalls ([Unit 42, 2026-10-14](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)). Unit 42 recovered the configurations' reversible-ciphertext credentials by brute force; the attackers later logged in over SSL VPN with legitimate credentials and pushed packet-capture settings to downstream firewalls ([Unit 42, 2026-10-14](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)). For root they used CVE-2025-61624, a path traversal in the FortiOS CLI system.auto-script engine that lets an authenticated administrative account read and write arbitrary files as root ([Unit 42, 2026-10-14](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)). That installed PEERSTITCH, an ARM64 injector that attaches with ptrace to the logging daemon miglogd and the IPsec daemon iked, allocates a 16 KB read-write-execute region, NOP-patches three fixed offsets and links the daemons through /proc memory so that tagged VPN sessions skip default FortiOS validation; it leaves no persistent binary on disk, opens no listening port and makes no outbound connection of its own ([Unit 42, 2026-10-14](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)). Command and control ran through the firewall's own Apache mod_md ACME module, whose DNS-01 challenge handler executes Node.js with parameters from an attacker-run ACME server and so opens a reverse shell ([Unit 42, 2026-10-14](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)). Fortinet's advisory FG-IR-26-122 of 2026-04-14 covers the CLI path traversal in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, lists it as known exploited, and for FortiOS gives fixes only in 7.6.5 and 7.4.10, telling users of 7.2, 7.0 and 6.4 to migrate to a fixed release ([Fortinet, 2026-04-14](https://fortiguard.fortinet.com/psirt/FG-IR-26-122)). **Exposure:** FortiOS on 7.2, 7.0 or 6.4, which have no fixed build, or on 7.6.0 to 7.6.4 and 7.4.0 to 7.4.9, with administrators who can reach the CLI ([Fortinet, 2026-04-14](https://fortiguard.fortinet.com/psirt/FG-IR-26-122)); and a FortiManager below 7.6.1, 7.4.5, 7.2.8, 7.0.13, 6.4.15 or 6.2.13 that is reachable on TCP 541 from untrusted networks, where the intrusion began ([Fortinet, 2024-10-23](https://fortiguard.fortinet.com/psirt/FG-IR-24-423); [Unit 42, 2026-10-14](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)). **Detection:** management-plane audit records of the FortiManager (device registrations, archive creation, TCP 541 sessions from outside the management network); FortiGate administrator and VPN logs for SSL VPN logins with valid credentials from new external addresses and for administrator accounts that match nobody in the estate, such as an unexpected FortiGateCloud account; gaps in forwarded syslog, because the actors stop the logging daemons before running scripts; and unexplained packet-capture settings ([Unit 42, 2026-10-14](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)). Unit 42's hunting guidance adds the memory maps of miglogd and iked (anonymous 16,384-byte rwxp regions), text-segment integrity at three fixed offsets, cross-process open and write on /proc//mem, signal-11 crashes of miglogd, iked or syslogd in the crash log, and configuration revisions holding auto-script objects with ../ in the name ([Unit 42, 2026-10-14](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)). **Triage:** legitimate FortiManager work also creates and deletes auto-scripts and adds devices; the report's signals are ../ in an auto-script name, a device registered from outside the management network, and accounts that match no administrator or tenant the organization created. **Defender takeaway:** plan the move off FortiOS 7.2, 7.0 and 6.4, where Fortinet offers no fix for an exploited root escalation ([Fortinet, 2026-04-14](https://fortiguard.fortinet.com/psirt/FG-IR-26-122)), and limit who can reach the administrative CLI meanwhile; after any suspected FortiManager compromise treat every managed device's credentials and certificates as compromised and rotate them, because the stolen trust material stays valid until it is rotated ([Unit 42, 2026-10-14](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)).