DEV Community

Anoymask
Anoymask

Posted on

PEERSTITCH: Theft of 500+ Firewall Configurations and Payload Injection into FortiGate Daemons

#security #threatintel

1. Overview

2. Quick Summary

CL-STA-0954 exploited FortiManager CVE-2024-47575 to steal configuration files, keys, and credentials for over 500 FortiGate devices, escalated to root via CVE-2025-61624, and injected the memory-resident ARM64 implant PEERSTITCH into miglogd and iked.

3. Attack Flow

Attack and Exploitation Vector

  1. The attackers sent a crafted request to FortiManager TCP/541 to register a rogue appliance.
  2. They generated and exfiltrated a configuration archive, obtaining information and credentials for over 500 firewalls.
  3. The attackers established unauthorized FortiGate VPN sessions using valid credentials. Separately, Unit 42 verified that passwords could be recovered from the stolen configurations.
  4. The attackers exploited the auto-script path traversal vulnerability CVE-2025-61624 to deploy the PEERSTITCH loader.
  5. The injector patched the memory of miglogd and iked, activating backdoor behavior through markers in legitimate traffic.

Separate C2 Channel Used Alongside PEERSTITCH

  1. Unit 42 also observed an outbound reverse shell abusing Apache mod_md alongside PEERSTITCH. The implant itself creates no outbound connections; this does not mean the overall intrusion generated no outbound traffic.

4. Attacker Position and Prerequisites

  • The intrusion begins with an unauthenticated attacker able to reach FortiManager TCP/541 from the internet, transitioning to an authenticated attacker with stolen administrator credentials.

5. Visible Indicators for Victims and Administrators

Victim Side

  • There may be no obvious change on users' screens; the effects involve unauthorized VPN sessions and traffic interception.

Administrator Side

  • Indicators include rogue FortiGate registrations, .tm archives, sniffer policies, auto-script path traversal, ptrace use, and read-write-execute (RWX) memory regions.

6. Success and Failure Conditions

Success Conditions

  • External reachability to a vulnerable FortiManager.
  • VPN re-entry requires valid credentials. Unit 42 verified that passwords could be recovered from the stolen configurations, but the attackers' own recovery steps require separate evidence.
  • CVE-2025-61624 requires vulnerable FortiOS and authentication with an administrator profile that has at least read/write privileges. VPN access alone does not necessarily provide these management privileges.

Affected Versions

CVE-2024-47575 affects FortiManager 6.2.0–6.2.12, 6.4.0–6.4.14, 7.0.0–7.0.12, 7.2.0–7.2.7, 7.4.0–7.4.4, and 7.6.0. Fortinet's CNA description identifies FortiOS 7.4.0–7.4.9, 7.6.0–7.6.4, and the 6.4, 7.0, and 7.2 branches as affected by CVE-2025-61624. The systems observed in this report were FortiManager and FortiGate.

Failure Conditions and Defensive Limits

  • Check the fixed releases for each CVE in Fortinet's CNA records, apply the updates, and restrict the sources allowed to reach TCP/541. Updating alone does not resolve the misuse of credentials and keys that have already been stolen.
  • Memory acquisition and process-integrity monitoring are post-compromise detection measures. If anomalies are found, proceed to isolation and recovery; monitoring alone is not evidence that intrusion was prevented.

Fixed Releases

For CVE-2024-47575, the fixed FortiManager releases are 6.2.13, 6.4.15, 7.0.13, 7.2.8, 7.4.5, and 7.6.1 or later in their respective branches. For CVE-2025-61624, Fortinet recommends FortiOS 7.4.10 or 7.6.5 and later. Because the 7.2, 7.0, and 6.4 branches are affected, verify an appropriate migration path to a fixed branch.

7. What Happens If the Attack Succeeds

  • Theft of firewall configurations, keys, and credentials for over 500 devices.
  • Establishment of VPN sessions and traffic interception.
  • Bypassing authentication validation and maintaining long-term access through a memory-only implant.

8. Observable Logs

The following are investigation candidates. Availability depends on the product, permissions, logging configuration, and retention period. Missing records do not prove that a system was not compromised.

  • Email: Inference: Email-based initial access has not been confirmed.
  • Proxy/SWG/DNS: Inference: Check communications from FortiManager/FortiGate to destinations such as 23.240.77[.]233.
  • Endpoint/EDR: Inference: Check for lldprx, index.wasm, ipssem.js, ptrace, and writes to /proc/*/mem.
  • Identity/IdP: Inference: Check sessions from 23.240.77[.]233 and 47.18.167[.]159 involving stolen VPN credentials.
  • SaaS/Cloud: Inference: Check FortiManager device-registration, revision, and policy-push audit records.
  • Network: Inference: Investigate TCP/541 and known external delivery and ACME destinations. The strings 8550 and 169.254.0.1 are markers inside traffic data; destination ports and IP addresses in flow logs alone cannot match this behavior.

9. Scope of Confirmed Success

Information Theft or Session Compromise Confirmed

  • Scope: Scope confirmed by public information
  • Basis: Public information: Exfiltration of an archive containing configurations, keys, and credentials for over 500 devices has been confirmed.

Subsequent Compromise Confirmed

  • Scope: The investigated MSP's environment. Intrusion into its customers' internal networks has not been confirmed.
  • Basis: Public information: The attackers re-entered through VPN sessions using stolen credentials and proceeded to deploy PEERSTITCH and intercept traffic.

Criteria for Internal Assessment

  • Separate contact, execution, information acquisition, and subsequent compromise; do not infer unconfirmed success from a single alert.

10. Investigation Playbook

  • Investigation Starting Point: Start from rogue device registrations, configuration archives, unknown VPN sessions, and auto-script traversal.
  • Initial Verification: Check FortiManager and FortiOS versions, TCP/541 exposure, device inventory, and credential rotation status.
  • Device and Server Investigation: Preserve appliance memory, miglogd and iked memory maps, evidence of /proc writes, and staging files.
  • Authentication and Cloud Investigation: Verify the use of all administrator and SSL-VPN credentials, certificates, and private keys.
  • Subsequent Operations: Expand the investigation to customer firewalls, packet captures, VPN sessions, and internal scans.
  • Containment: Isolate the management plane, preserve evidence, and update to fixed releases. Rotate credentials, keys, and certificates within the compromise scope after assessing dependencies and the risk of connectivity disruption. Rebuild from trusted images where necessary.
  • Judgment Categories: Distinguish configuration theft, credential use, root escalation, implant injection, and customer compromise.

11. Defense and Detection Ideas

  • Single Events: Detect rogue FortiGate registrations from external IPs and ../ in auto-script names.
  • Time-Series Correlation: Correlate TCP/541 registration -> .tm generation -> exfiltration -> VPN login -> loader download -> ptrace.
  • Threat Hunting: Check RWX regions in miglogd and iked and memory writes through /proc.
  • Log Limitations: PEERSTITCH itself creates no listening ports or outbound connections, so disk and flow logs alone are insufficient. An outbound reverse shell abusing Apache mod_md was also observed in the same intrusion; investigate its communications as well.
  • Priority Countermeasures: Prioritize patching, management-plane restrictions, memory forensics, and credential/key rotation.

12. Facts, Inference, and Hypothesis

Facts

  • The intrusion began with the compromise of a telecommunications MSP in September 2024, using FortiManager CVE-2024-47575 for initial access.
  • The attackers registered a rogue Virtual FortiGate named localhost and exfiltrated an archive containing running configurations, databases, public IP addresses, credentials, and private keys associated with over 500 devices.
  • Unit 42 verified that administrator and SSL-VPN passwords could be recovered from the stolen configurations. Separately, it observed the attackers using valid credentials to connect through VPN sessions; the attackers' own password-recovery procedure has not been disclosed.
  • The attackers exploited CVE-2025-61624 auto-script path traversal for file writes and execution as root to deploy PEERSTITCH.
  • PEERSTITCH uses an ARM64 injector to attach to miglogd and iked through ptrace and write a 1,344-byte payload into RWX memory.
  • PEERSTITCH leaves no persistent binary on disk, creates no listeners or outbound connections, and monitors traffic markers processed by legitimate processes.
  • It extracts tags using 8550 and 169.254.0.1 as markers inside traffic data, then shares them between daemons through /proc/<pid>/mem to bypass VPN validation. The 8550 marker does not designate a listening port.

Inference

  • Public facts must be mapped to internal assets and logs for validation.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in section 14, Unresolved Questions and Further Investigation.

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application high Exploited FortiManager CVE-2024-47575.
T1602.002 Data from Configuration Repository: Network Device Configuration Dump high Unit 42 confirmed the exfiltration from FortiManager of an archive containing running configurations for managed FortiGate devices. This is distinct from dumping an operating-system credential store.
T1055 Process Injection high Injected a payload into the memory of miglogd and iked.
T1040 Network Sniffing high Pushed sniffer configurations to managed firewalls.

14. Unresolved Questions and Further Investigation

  • Whether the attackers entered the individual customer networks associated with the 500+ devices, their ultimate objective, and formal threat-actor attribution remain unconfirmed.

15. Impact on SOCs and Organizations

A compromise of centralized management can expose configurations and keys for firewalls protecting numerous customers. Memory investigation is important because PEERSTITCH operates inside legitimate daemons. Investigators should also account for network traces from the outbound reverse shell used alongside it.

16. Summary by Target Audience

  • For SOCs: Review FortiManager registrations, archives, VPNs, auto-scripts, and daemon memory as a continuous chain.
  • For Administrators: Restrict TCP/541, update to fixed releases, and comprehensively rotate administrative credentials and cryptographic material.
  • For Users: Promptly follow administrators' instructions regarding re-authentication or credential changes when using VPNs.

Top comments (0)