DEV Community

Anoymask
Anoymask

Posted on Edited on

PEERSTITCH: Theft of 500+ Firewall Configurations and Payload Injection into FortiGate Daemons

#security #threatintel

1. Basic Information

2. Executive Summary

CL-STA-0954 used FortiManager CVE-2024-47575 to steal configurations, keys, and credentials for over 500 FortiGate devices, and then leveraged CVE-2025-61624 to escalate privileges to root, injecting the memory-resident ARM64 implant PEERSTITCH into miglogd and iked.

3. Attack Flow

Attack and Exploitation Path

  1. Send a crafted request to FortiManager TCP/541 to register a rogue appliance.
  2. Generate and exfiltrate the configuration archive, obtaining firewall information and credentials for more than 500 devices.
  3. Attackers successfully connected to the FortiGate VPN using valid credentials. Unit 42 has independently verified the possibility of password recovery from the leaked configurations.
  4. Deploy the PEERSTITCH loader by exploiting auto-script path traversal via CVE-2025-61624.
  5. The injector applies a memory patch to miglogd and iked, triggering backdoor processing based on markers within legitimate traffic.

Alternative C2 Channel Used in Conjunction

  1. Alongside PEERSTITCH, Unit 42 observed an outbound reverse shell abusing Apache mod_md. The fact that PEERSTITCH itself does not open outbound connections does not mean the entire intrusion lacks outbound traffic.

4. Attacker Positioning and Prerequisites

  • The attack begins with an unauthenticated attacker able to reach FortiManager TCP/541 from the internet, transitioning to an authenticated attacker holding stolen admin credentials.

5. Visibility for Victims and Administrators

Victim Side

  • Users experience no distinct screen changes, though the impact manifests as VPN sessions or traffic interception.

Administrator Side

  • Manifests as rogue FortiGate registrations, .tm archives, sniffer policies, auto-script path traversal, ptrace usage, and RWX memory allocations.

6. Success and Failure Conditions

Success Conditions

  • External network reachability to the vulnerable FortiManager.
  • Re-entering the VPN requires valid credentials. While Unit 42 verified password recovery from leaked configurations, actual recovery operations by the attackers require separate confirmation.
  • CVE-2025-61624 requires a vulnerable version of FortiOS and authentication with at least read-write administrator privileges. A VPN connection alone does not necessarily grant this administrative privilege level.

Scope

CVE-2024-47575: FortiManager 6.2.0–6.2.12, 6.4.0–6.4.14, 7.0.0–7.0.12, 7.2.0–7.2.7, 7.4.0–7.4.4, 7.6.0. CVE-2025-61624: FortiOS 7.4.0–7.4.9, 7.6.0–7.6.4, and the 6.4 / 7.0 / 7.2 series (per Fortinet CNA descriptions). The scope of observation in this article covers FortiManager and FortiGate.

Failure Conditions and Defensive Divergence

  • Verify and update to the remediation levels for each CVE according to Fortinet CNA records, and restrict inbound access to TCP/541. Applying updates alone does not remediate already leaked credentials and keys.
  • Memory acquisition and process integrity monitoring are post-compromise detection mechanisms. If anomalies are detected, proceed to isolation and recovery, and do not treat monitoring activities as a preventive control against intrusion.

Remediation Levels

For CVE-2024-47575, the remediation levels are FortiManager 6.2.13, 6.4.15, 7.0.13, 7.2.8, 7.4.5, 7.6.1 and later. For CVE-2025-61624, Fortinet advises updating to FortiOS 7.4.10 / 7.6.5 and later. Because the 7.2, 7.0, and 6.4 series are affected, confirm migration to their respective patched versions.

7. What Happens Upon Success

  • Exfiltration of firewall configurations, keys, and credentials for over 500 devices.
  • Establishment of VPN sessions and traffic interception.
  • Bypassing authentication validation and achieving persistent access via a memory-only implant.

8. Observable Logs

Below are investigative candidates. Availability depends on the product, privileges, logging settings, and retention periods; an absence of records does not prove an absence of compromise.

  • Email: Inference: Email-based initial access has not been confirmed.
  • Proxy/SWG/DNS: Inference: Check for communications from FortiManager/FortiGate to IP addresses such as 23.240.77[.]233.
  • Endpoint/EDR: Inference: Check for lldprx, index.wasm, ipssem.js, ptrace, and /proc/*/mem write activities.
  • Identity/IdP: Inference: Check for sessions originating from 23.240.77[.]233 and 47.18.167[.]159 using stolen VPN credentials.
  • SaaS/Cloud: Inference: Verify FortiManager device registrations, revisions, and policy push audit logs.
  • Network: Inference: Investigate TCP/541 traffic and known external distribution or ACME endpoints. Note that 8550 and 169.254.0.1 are strings within communication payloads and cannot be matched using flow log destination ports and IPs alone.

9. Scope of Success Confirmation

Confirmation of Information Theft or Session Compromise

  • Scope: Scope confirmed via publicly available information.
  • Basis: Public information confirms the exfiltration of archives containing configurations, keys, and credentials for over 500 devices.

Confirmation of Subsequent Compromise

  • Scope: Scope confirmed within the environment of the investigated MSP. Intrusions into customer internal networks remain unconfirmed.
  • Basis: Public information indicates attackers re-entered the VPN using stolen credentials, leading to PEERSTITCH deployment and traffic interception.

Organizational Criteria for Determination

  • Distinguish between contact, execution, information acquisition, and subsequent compromise; do not infer unconfirmed success from a single alert.

10. Investigation Playbook

  • Investigation Starting Point: Begin with rogue device registrations, configuration archives, unfamiliar VPN sessions, and auto-script path traversal.
  • Initial Checks: Verify FortiManager/FortiOS versions, TCP/541 exposure, device inventories, and credential rotation status.
  • Endpoint/Server Investigation: Preserve appliance memory, miglogd/iked memory maps, /proc write activities, and staging files.
  • Identity/Cloud Investigation: Verify the usage of all admin and SSL-VPN credentials, certificates, and private keys.
  • Subsequent Actions: Broaden the scope to client firewalls, packet captures, VPN sessions, and internal network scans.
  • Containment: Isolate the management plane to preserve evidence and update to patched versions. Rotate credentials, keys, and certificates across affected dependent paths after assessing communication impacts, and rebuild from trusted images if necessary.
  • Classification Categories: Differentiate between configuration theft, credential utilization, root privilege escalation, implant injection, and client compromise.

11. Defense and Detection Ideas

  • Single Events: Detect rogue FortiGate registrations from external IP addresses and auto-script names containing ../.
  • Temporal Correlation: Correlate TCP/541 registration -> .tm generation -> exfiltration -> VPN login -> loader download -> ptrace.
  • Threat Hunting: Check for RWX memory regions in miglogd/iked and memory write operations via /proc.
  • Log Limitations: Because the PEERSTITCH core does not open listening ports or outbound connections, relying solely on disk artifacts and traffic flows is insufficient for detection. Outbound reverse shells abusing Apache mod_md were also identified in the same compromise and should be investigated.
  • Priority Actions: Prioritize patching based on CISA KEV listings, restricting the management plane, performing memory forensics, and executing credential and key rotation.

12. Facts / Inference / Hypothesis

Facts

  • The attack occurred during a telecommunications MSP compromise in September 2024, utilizing FortiManager CVE-2024-47575 for initial access.
  • Attackers registered a rogue virtual FortiGate localhost and exfiltrated an archive containing running configurations, databases, public IP addresses, credentials, and private keys for over 500 devices.
  • Unit 42 verified that administrator and SSL-VPN passwords could be recovered from the leaked configurations. They separately confirmed that attackers connected to the VPN using valid credentials, though the attackers' specific recovery procedures were not published.
  • Root file write and execution were achieved via auto-script path traversal in CVE-2025-61624 to deploy PEERSTITCH.
  • PEERSTITCH uses an ARM64 injector to attach via ptrace to miglogd and iked, writing a 1,344-byte payload into RWX memory.
  • It leaves no persistent binaries on disk, establishes no listeners or outbound connections, and monitors traffic markers processed by legitimate system processes.
  • It extracts tags using 8550 and 169.254.0.1 found within communication data as markers, sharing them across daemons via /proc/<pid>/mem to bypass VPN verification. Note that 8550 does not represent a listening port.
  • CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities Catalog on October 16, 2026.

Inference

  • Public facts must be mapped and verified against internal organizational assets and logs.

Hypothesis

No additional hypotheses. Unverified items are documented under 'Unknowns and Additional Investigation'.

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application high Exploited FortiManager CVE-2024-47575.
T1602.002 Data from Configuration Repository: Network Device Configuration Dump high Unit 42 confirmed the exfiltration of archives containing running configurations of managed FortiGate devices from FortiManager. Distinguished from dumping OS credential stores.
T1055 Process Injection high Injected memory into miglogd and iked.
T1040 Network Sniffing high Pushed sniffer configurations to managed firewalls.

14. Unknowns and Additional Investigation

  • Compromise status within each of the 500+ client networks, ultimate objectives, and formal attribution of the threat actor remain unconfirmed.

15. Impact on SOCs and Organizations

Compromise of a centralized management appliance broadens the impact to firewall configurations and cryptographic keys protecting numerous customers. Because the PEERSTITCH core operates within legitimate daemons, memory forensics is crucial; however, investigators must also ensure they do not overlook communication artifacts from the concurrently used outbound reverse shell.

16. Audience-Specific Summary

  • For SOCs: Review FortiManager registrations, archives, VPN sessions, auto-scripts, and daemon memory as a correlated sequence.
  • For Administrators: Restrict TCP/541, update to patched versions, and comprehensively rotate administrative credentials and cryptographic material.
  • For Users: Promptly follow any instructions from administrators regarding re-authentication or credential updates for VPN access.

Top comments (0)