Affected Systems

Fortinet FortiManager and 500+ managed FortiGate firewalls. Initial compromise via CVE-2024-47575 (FortiJump) on FortiManager FMG-Access service (TCP 541). Secondary exploitation via CVE-2025-61624 (FortiOS auto-script path traversal) enabled deployment of PEERSTITCH, a memory-resident ARM64 implant. Telecommunications managed service provider and downstream client networks affected.

Exploitation Status

Active exploitation confirmed. CVE-2024-47575 exploited in September 2024 against FortiManager to exfiltrate configurations, credentials, and cryptographic material for 500+ managed FortiGate devices. CVE-2025-61624 subsequently exploited to deploy PEERSTITCH malware. Attack attributed to CL-STA-0954 (aka UNC5820) with suspected nation-state tradecraft. PEERSTITCH is memory-resident, leaves no disk artifacts, and evades conventional detection by communicating through legitimate process traffic.

Business Impact

Critical supply chain compromise affecting network perimeter security for telecommunications provider and downstream clients. Attackers obtained complete running configurations, administrative credentials, SSL/VPN keys, and cryptographic trust material for 500+ FortiGate firewalls. Threat actors deployed network sniffers targeting cleartext protocols (HTTP, Telnet) across 11 TCP ports to intercept credentials and map internal topology. PEERSTITCH implant provides persistent, stealthy access resistant to endpoint and network detection. Incident demonstrates advanced understanding of FortiOS internals and management protocols. Client networks managed by compromised provider face credential theft and unauthorized VPN access risk.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately isolate and forensically image all FortiManager appliances; search logs for unauthorized device registrations (serial FMG-VMTM23017412, IPs 45.32.41[.]202 and 198.199.122[.]22) and suspicious .tm archive creation on FMG-Access (TCP 541)
  • Apply Fortinet patches for CVE-2024-47575 (FortiManager) and CVE-2025-61624 (FortiOS auto-script path traversal) to all FortiManager and FortiGate devices; verify patch integrity before reconnecting to production
  • Rotate all administrative credentials, SSL/VPN certificates, and cryptographic keys on FortiManager and managed FortiGate firewalls; assume all credentials in running configurations are compromised
  • Hunt for unauthorized packet capture configurations on FortiGate devices targeting HTTP and TCP ports 3696-3701; review FortiManager push logs for anomalous sniffer policy deployments
  • Inspect FortiGate memory for PEERSTITCH indicators using live forensics tools; monitor for traffic anomalies in legitimate process communications; reboot devices to clear memory-resident implants and apply hardened configurations