A recent cyberattack has leveraged vulnerabilities in Fortinet’s firewall management systems to deploy a stealthy malware strain known as PEERSTITCH. Attackers first infiltrated a telecommunications managed service provider by exploiting Fortinet’s centralized management tools—then used that foothold to harvest credentials and implant malicious code in connected firewalls.
Initial Breach via FortiManager Vulnerability
The intrusion began when attackers compromised a FortiManager appliance, giving them access to sensitive configurations related to over 500 FortiGate firewalls under its care. Their access to this archive exposed device serials, public IP addresses, network routing rules, firewall policies, and certificates used for authentication and trust between FortiManager and the firewalls. Encrypted administrative and VPN credentials included in the archive were successfully decrypted by the attackers. This breach traced back to CVE-2024-47575 (FortiJump), a weakness that lets unauthenticated remote actors send crafted requests to FortiManager and execute commands.
Escalated Control via FortiGate Malware Implant
After acquiring access to trust material and credentials, attackers misused another vulnerability: CVE-2025-61624 in FortiOS’s auto-script feature. With this path‐traversal flaw, they were able to write files outside designated directories with root privileges. These files included a loader named lldprx, plus JavaScript, WebAssembly, and other modules.
Once deployed, the loader targeted FortiGate’s internal processes—specifically miglogd (logging) and iked (VPN functionality). Injecting into these processes, PEERSTITCH established in-memory payload areas and redirected execution flows to evade traditional detection. It does not leave persistent binaries, open listening ports, or create distinct outbound connections. Instead, it operates covertly inside legitimate system processes, using session tags to intercept and modify VPN traffic when certain markers are present.
Secondary Channel and Cleanup Operations
To maintain remote control, attackers also compromised the mod_md module in Apache, designed for automated certificate management. They injected commands into certificate validation routines running via Node.js, creating a backdoor. To evade discovery, they disabled logging, purged crash records, removed malicious accounts and scripts, and restored corrupted configuration files to innocuous forms.
Detection Indicators and Response Steps
Organizations using FortiManager and FortiGate should watch for anomalies such as unexpected device registrations, unfamiliar administrator accounts, and auto-script entries containing path traversal strings (e.g. “../../”). Suspicious VPN sessions, mismatches in firewall configurations compared to known good backups, and readable credentials or trust material stored on FortiManager should be considered compromised.
Indicators of compromise include specific SHA-256 hashes for PEERSTITCH components, IP addresses used for staging and installation, URLs linked to the malware’s staging scripts, and file paths like lldprx and various JavaScript/WebAssembly modules. Forensics should also inspect memory maps of miglogd and iked for unusual executable memory regions, cross-process writes to /proc/, or patches at unexpected offsets.
Malware of this type highlights the risk of relying on centralized management systems like FortiManager. Once compromised, they can become a launchpad for deeper infiltration. The multi-stage nature of PEERSTITCH demonstrates how attackers can defeat perimeter defenses by blending into system processes. What to look for now: patches or mitigation advice from Fortinet for CVE-2024-47575 and CVE-2025-61624; steps by affected organizations to audit credentials and trust chains; and whether detection tools evolve to catch process-memory implants rather than just files on disk.
