Affected Systems

Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager vulnerable to CVE-2025-61624 (CVSS 5.4), a path traversal flaw in the command line interpreter. Patched by Fortinet in April 2026. Attack chain also leveraged CVE-2024-47575 (FortiJump) for initial access via FortiManager. Observed exploitation targeted telecommunications managed service provider in September 2024.

Exploitation Status

Active exploitation confirmed. Advanced threat actor (tracked as CL-STA-0954/UNC5820) deployed PEERSTITCH, a memory-resident ARM64 malware, in multi-stage intrusion against telecommunications MSP. Attack chain began with FortiManager compromise (CVE-2024-47575), followed by privilege escalation via CVE-2025-61624 to deploy PEERSTITCH on FortiGate firewalls.

Business Impact

High-severity supply chain attack targeting centralized management infrastructure. Attackers compromised FortiManager to harvest configurations, credentials, and cryptographic material for 500+ managed FortiGate firewalls, enabling lateral movement across internal and client networks. PEERSTITCH malware is memory-resident only, hooks legitimate FortiOS processes (miglogd, iked), bypasses VPN session validation, and evades conventional endpoint/network detection. Attackers demonstrated deep knowledge of FortiOS internals, established persistent C2 via Apache mod_md module, and actively removed forensic artifacts. Telecommunications MSPs and organizations using centralized Fortinet management platforms face elevated risk of compromise affecting multiple downstream clients.

Urgency

🔴 Immediate

Recommended Actions

  • Verify all FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager devices are patched to versions released after April 2026 addressing CVE-2025-61624 and CVE-2024-47575 (FortiJump).
  • Audit FortiManager appliances for unauthorized access: review administrator account creation/deletion logs, check for unexpected configuration exports, and validate cryptographic trust material integrity.
  • Hunt for PEERSTITCH indicators: inspect running processes for unexpected ptrace activity targeting /bin/miglogd and /bin/iked, monitor for traffic patterns involving TCP port marker 8550 and IP 169.254.0.1, and check for Apache mod_md module abuse spawning SSH reverse shells.
  • Review FortiGate SSL/VPN session logs for anomalous sessions bypassing authentication, especially those originating from IP 23.240.77.233 or exhibiting tagged session behavior.
  • Implement network segmentation to limit FortiManager's ability to access managed devices, enable enhanced logging on FortiOS daemons, and monitor for syslog disruption or crash log clearing indicative of anti-forensics activity.

---

# Threat Actor Context

Actor Profile

The threat actor behind this intrusion, tracked as CL-STA-0954 (also known as UNC5820), is a suspected advanced persistent threat group demonstrating deep proficiency in Fortinet appliance architecture, FortiOS internals, and FortiOS management protocols. Their motivation appears to be long-term espionage and network access, targeting telecommunications managed service providers to gain access to extensive downstream client networks. The actor exhibits sophisticated operational security, employing memory-resident malware, anti-forensic techniques including syslog termination and crash log clearing, and leveraging centralized management platforms to pivot across managed infrastructure. The origin and specific attribution of this actor remain unconfirmed, though the technical sophistication and targeting profile suggest a state-sponsored or highly capable threat group focused on telecommunications infrastructure compromise.

TTPs (Tactics, Techniques, Procedures)

Initial access was achieved via exploitation of CVE-2024-47575 (FortiJump), a critical Fortinet FortiManager vulnerability. The actor then leveraged CVE-2025-61624, a path traversal flaw in FortiOS command line interpreter, for privilege escalation and arbitrary file write/delete operations. Post-compromise activities included credential harvesting and exfiltration of FortiManager configurations, cryptographic material, and database files containing details of 500+ managed FortiGate firewalls. The actor deployed PEERSTITCH, a memory-resident ARM64 malware that uses process injection (ptrace-based) to hook legitimate FortiOS daemons (/bin/miglogd and /bin/iked), creating covert inter-process communication channels. Additional persistence was established through Apache mod_md module abuse for SSH-based reverse shells. The actor demonstrated lateral movement by impersonating FortiManager to pull configurations from managed firewalls. Anti-forensic measures included syslog termination, crash log clearing, logging telemetry disruption, and automatic deletion of rogue administrator accounts and auto-script objects. Relevant MITRE ATT&CK techniques include T1190 (Exploit Public-Facing Application), T1068 (Exploitation for Privilege Escalation), T1055 (Process Injection), T1027 (Obfuscated Files or Information), T1562.001 (Impair Defenses: Disable or Modify Tools), T1070 (Indicator Removal), and T1572 (Protocol Tunneling).

Targets & Patterns

The primary target was a telecommunications managed service provider, selected likely for its role as a centralized management point for extensive downstream client networks. By compromising the FortiManager appliance, the actor gained access to configuration data, credentials, and network topology information for over 500 managed FortiGate firewalls across both internal infrastructure and client networks. This targeting pattern reflects a strategic focus on telecommunications and network security infrastructure, where a single compromise yields access to multiple downstream organizations. The selection of managed service providers as initial targets demonstrates an understanding of supply chain attack vectors and the multiplier effect of compromising centralized management platforms. The actor's focus on VPN infrastructure and SSL/VPN sessions suggests interest in monitoring or intercepting remote access traffic, consistent with espionage objectives targeting sensitive communications.

Historical Context

This intrusion, tracked as CL-STA-0954 (UNC5820), was discovered during investigation of a prolonged network intrusion that took place in September 2024 against a telecommunications managed service provider. The campaign leveraged CVE-2024-47575 (FortiJump), which was exploited in the wild during 2024, and CVE-2025-61624, patched by Fortinet in April 2026. The discovery of PEERSTITCH represents the first public documentation of this memory-resident ARM64 malware family. While Unit 42 noted potential links to exploitation of CVE-2024-26009 and CVE-2024-26008, these connections remain unconfirmed. The campaign demonstrates evolution in anti-detection techniques, with PEERSTITCH representing a sophisticated approach to memory-resident persistence that avoids conventional network and endpoint detection signatures. The actor's focus on Fortinet infrastructure and demonstrated expertise in FortiOS internals suggests either prior experience with these platforms or significant investment in capability development targeting this vendor's ecosystem.

Defensive Recommendations

  • Immediately patch CVE-2024-47575 (FortiJump) and CVE-2025-61624 on all Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager devices to prevent initial access and privilege escalation vectors
  • Monitor FortiManager and FortiGate devices for unauthorized configuration pulls, unusual management protocol traffic, and unexpected device enrollment or impersonation attempts using FortiManager audit logs
  • Implement behavioral detection for process injection techniques (T1055) by monitoring for ptrace system calls targeting critical FortiOS daemons such as /bin/miglogd and /bin/iked, particularly from unexpected parent processes
  • Establish baseline monitoring for Apache mod_md module usage on FortiGate firewalls and alert on unexpected SSH reverse shell spawning or outbound connections from web server processes
  • Deploy detection rules for anti-forensic activities including sudden syslog termination, crash log clearing, and automatic deletion of administrator accounts; correlate these events with other suspicious indicators to identify active intrusions
  • Monitor VPN session establishment for anomalous patterns, particularly sessions tagged with unusual markers (e.g., TCP port 8550 in traffic data, link-local IP 169.254.0.1) that may indicate PEERSTITCH-style session validation bypass
  • Implement network segmentation and zero-trust controls to limit lateral movement from compromised management appliances to managed devices, and enforce strict authentication for FortiManager-to-FortiGate communications