More than 500 managed FortiGate firewalls — including their running configurations, cryptographic materials and topology maps — were harvested from a compromised FortiManager appliance and then used to stage a novel, diskless ARM64 implant that sidesteps normal detection, Palo Alto Networks Unit 42 reported.
FortiManager compromise and harvested FortiGate data
Unit 42 says the activity was discovered as part of a prolonged intrusion against a telecommunications managed service provider in September 2024, tracked as CL-STA-0954 (aka UNC5820). Initial access was obtained by exploiting a critical FortiManager vulnerability known as FortiJump (CVE-2024-47575). After control of the FortiManager appliance, the attackers exfiltrated an archive that included:
- the FortiManager appliance's serial number and management relationships to every enrolled device;
- running configuration files for more than 500 managed FortiGate firewalls;
- central management SQLite databases and an inventory mapping more than 500 FortiGate serial numbers to public IP addresses;
- internal network topology maps, routing tables and interface configurations;
- ciphertext administrative, local, and SSL/VPN credentials; and
- encoded cryptographic trust material, including public certificates and private keys.
Unit 42 says the stolen information was then weaponized for network reconnaissance, long-term access, interception of traffic, the setup of unauthorized FortiGate SSL/VPN sessions and deployment of backdoors.
PEERSTITCH: a memory-resident ARM64 implant that avoids disk and network artifacts
After exploiting a separate FortiOS privilege-escalation flaw (CVE-2025-61624, CVSS 5.4), the attackers deployed a previously unreported ARM64 malware family Unit 42 calls PEERSTITCH. Unit 42 researchers Daniel Gott and Shawn Westfall summarized the implant’s operational profile: “PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections.”
PEERSTITCH is a 64-bit Linux ARM64 executable written in C that functions as a one-shot injector and downloads five components from an external server at 23.240.77[.]233:8085. Unit 42 lists those components as:
- pM.js — an environment preparation script (self-deleting);
- a.js (saved as index.js) — an Emscripten JavaScript runtime module;
- a.wasm (saved as index.wasm) — a compiled WebAssembly binary module;
- b.js (saved as ipssem.js) — a deployment orchestrator script; and
- dd (saved as lldprx) — a native ARM64 ELF binary injector (the PEERSTITCH core).
Following an execution delay, the orchestrator launches lldprx, which performs in-memory process patching rather than writing files or opening network listeners.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCVE-2025-61624 and injected hooks that bypass VPN session checks
lldprx targets two FortiOS daemons — /bin/miglogd and /bin/iked — by enumerating their memory, attaching via ptrace, halting execution with PTRACE_INTERRUPT, allocating executable memory, writing malicious code and redirecting execution into the injected code. The hooks create a “covert, memory-resident communication bridge” between the two legitimate processes that substitutes for conventional network C2s or disk artifacts.
Unit 42 describes a marker-based handoff: the miglogd hook looks for embedded markers in traffic data — specifically a TCP port marker “8550” (embedded in traffic, not a listening port) and an IP address marker “169.254.0.1” (a link-local identifier used for pattern matching). When miglogd finds the pattern it passes a session token or identifier to iked. The iked hook later looks for that identifier in a VPN session’s injection buffer and, if present, follows an alternate execution path that bypasses FortiOS default security validations and VPN session checks.
Unit 42 concludes that by operating as a one-shot injector, avoiding persistent disk artifacts and building a covert inter-process communication bridge inside process memory, the attackers “achieved sustained persistence while evading traditional monitoring.”
Apache mod_md abuse, SSH reverse-shells and forensic countermeasures
In addition to PEERSTITCH, Unit 42 observed the threat actor leveraging the Apache mod_md module on FortiGate firewalls to spawn an SSH-based reverse shell as a separate command-and-control channel. The attackers also impersonated the FortiManager platform to pull configurations from managed firewalls elsewhere in the targeted network.
Unit 42 further reports the intruders undertook active measures to remove forensic artifacts: termination of syslog generation, crash log clearing, disruption of logging telemetry, and automatic deletion of rogue administrator accounts and auto-script objects after execution.
The researchers note the attackers demonstrated high proficiency in Fortinet appliance architecture, FortiOS internals and management protocols. Unit 42 also flagged suspected exploitation of other vulnerabilities (CVE-2024-26009 and CVE-2024-26008) but emphasized those require FortiGate Cloud/FortiCloud SSO enrollment, which the affected firewalls did not hold.
What this means for technologists, procurement leaders, and managed service providers
Technologists and security teams should treat in-memory process hooks and marker-based inter-process signaling as indicators distinct from conventional file-based or network-based detection. Procurement leaders and CISOs responsible for managed devices must account for the risks of centralized management platforms: Unit 42 describes the FortiManager compromise as the pivot that exposed hundreds of downstream devices. Managed service providers should scrutinize appliance integrity and audit harvestable artifacts such as running configs, key material and management relationships that can be weaponized.
This intrusion illustrates how access to centralized edge-management infrastructure can be weaponized to reach large numbers of downstream devices and then install implants that deliberately avoid disk and network footprints. Unit 42’s reporting leaves one concrete operational question: how many other deployments had the exact FortiManager–FortiGate management mapping and cryptographic material that would allow a similar chain? The answer will determine whether this remains an isolated incident or a template for broader edge-targeting campaigns.
Original reporting: https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html
