“From that single appliance, our observations are that the attackers exfiltrated an archive containing running configurations, cryptographic material and database files containing information about more than 500 managed FortiGate firewalls.”
How the intrusion began: CVE-2024-47575 and FortiManager compromise
Unit 42 traced a multi-stage intrusion in September 2024, tracked as cluster CL-STA-0954 (aka UNC5820), to the exploitation of CVE-2024-47575 — an unauthenticated command-execution flaw in FortiManager’s FMG-Access channel (TCP 541). The attackers registered a rogue Virtual FortiGate appliance named localhost and, from external infrastructure, generated and exfiltrated a FortiManager configuration archive (.tm). That archive contained running configurations for more than 500 downstream FortiGate devices, central SQLite databases (global.db and revinfo.db), an inventory of FortiGate serial numbers and public IPs, and encoded cryptographic trust material including private keys.
Weaponizing management data: interception, VPN access, and impersonation
With the stolen archive in hand, the attackers pushed unauthorized packet-capture configurations to multiple managed FortiGates, targeting unencrypted HTTP and at least 11 specific services, then later expanding to perimeter captures of TFTP (UDP 69), RADIUS (UDP 1812/1813), and LDAP (TCP 389). Unit 42 demonstrated that credentials stored as reversible ciphertext in the exported configurations were brute-forceable; using recovered credentials, attackers established SSL/VPN sessions to perimeter firewalls from known staging hosts (23.240.77[.]233 and 47.18.167[.]159), gaining authenticated internal access.
Unit 42 further documents that following FGFM interactions from external hosts, an administrative account named FortiGateCloud downloaded running configurations. The investigators assess with medium confidence the attackers impersonated the FortiManager — either by exploiting CVE-2024-26009 to bypass FGFM authentication or by reusing the exfiltrated trust material — and may have terminated the legitimate manager’s session, possibly leveraging CVE-2024-26008.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildPEERSTITCH: a one-shot, memory-only ARM64 implant
To escalate to root and deploy a stealthy implant, the attackers exploited CVE-2025-61624, an auto-script path-traversal in FortiOS. That allowed placement of a file named ../../../../setup and retrieval of five components from hxxp[:]//23.240.77[.]233:8085 into /data2/template/: JavaScript and WebAssembly modules plus a native ARM64 ELF injector named lldprx (the PEERSTITCH core). PEERSTITCH is a statically linked 64-bit ARM64 executable that attaches to two FortiOS daemons — /bin/miglogd and /bin/iked — using ptrace, allocates RWX memory, and injects 1,344 bytes of payload into each target process.
Instead of establishing sockets or writing persistent binaries, PEERSTITCH creates a covert, memory-resident inter-process communication bridge: hooks inside each daemon scan in-flight data for two specific markers (TCP port 8550 and IP 169.254.0.1), extract short session tokens into a 16-slot circular buffer, and write those tags into the counterpart daemon’s memory via /proc/<pid>/mem. When iked later processes a matching tag, the hook diverts execution along an alternate path that bypasses FortiOS security checks. The implant patches static offsets in daemon memory with NOPs and places a trampoline to the RWX hook buffer; it leaves no persistent files on disk, opens no listening ports, and initiates no outbound connections.
Apache mod_md abuse and a novel outbound reverse shell
The attackers also weaponized Apache’s mod_md (ACME) on FortiGates. By pushing an auto-script to create ../../tmp/apache2/conf/md-acme.conf, they configured the ACME challenge workflow to call /bin/node for DNS-01 validation. The logged account.json and order.json state files show ACME directory and order URLs pointing to attacker infrastructure. Injecting shell commands into the domain-name field of ACME challenges allowed execution of an SSH reverse shell (kali@23.240.77[.]233:8084:b -F /tmp/upfile/ssh_config -i). Setting MDRenewMode to force continuous renewals ensured repeated execution of the injected payload and a persistent outbound channel.
Anti-forensics, supply-chain implications, and response priorities for managed-service providers, enterprise security teams, and Palo Alto Networks customers
- Managed-service providers: The report makes the management platform itself the highest-value target. Providers that manage infrastructure for clients must assume that any compromise of a central appliance exposes cryptographic trust material, credentials and topology data for all managed devices and treat those credentials as immediately compromised, requiring full rotation.
- Enterprise security teams: Detection of PEERSTITCH requires memory-forensics and process-hunting techniques because the implant leaves no disk artifacts or network listeners. Hunters should examine /proc/<pid>/maps and in-memory patches in /bin/miglogd and /bin/iked, and look for indicators such as injected RWX buffers and the tag markers described by Unit 42.
- Palo Alto Networks customers: Unit 42 lists product protections (Advanced WildFire, Advanced URL Filtering/DNS/IP Defense, Next-Generation Firewall with Advanced Threat Prevention, Cortex Xpanse, Device Security) and describes signatures (95788, 96788) and reputation updates designed to detect related activity.
The intrusion demonstrates a simple, painful truth: central management ecosystems concentrate risk. One compromised FortiManager yielded credentials, certificates and topology for 500+ firewalls and enabled in-memory implants that evade classic controls. Unit 42’s closing recommendation is unambiguous — treat management platforms with zero-trust isolation and rotate trust material the moment a platform is breached — because a patch does not return what attackers already took.
https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
