UNIT 42 reports a multi-stage intrusion against a telecommunications provider, which began in September 2024 with the exploitation of CVE-2024-47575 against a FortiManager appliance. The attackers registered a rogue Virtual FortiGate named localhost on the central FortiManager and exfiltrated a configuration archive (.tm) containing running configurations for more than 500 FortiGate devices, along with central management databases and cryptographic material.
The scope of the exposed data included device serials, IPs, topology maps, routing, and credentials, creating a high-value target for subsequent operations across the managed network.
Following the initial access, the intruders conducted reconnaissance and traffic interception from the compromised FortiManager, pushing unauthorized sniffer configurations to downstream FortiGate firewalls to capture unencrypted traffic and map perimeters. They brute-forced credentials recovered from exfiltrated configurations to establish FortiGate SSL/VPN sessions, gaining authenticated access to internal management segments.
A separate privilege-escalation stage used CVE-2025-61624 to read and write arbitrary files as root via a path traversal in the FortiOS auto-script engine, enabling the deployment of PEERSTITCH, a memory-resident ARM64 malware. PEERSTITCH operates as a one-shot injector, patching memory in /bin/miglogd and /bin/iked, creating a covert IPC bridge, and evading disk persistence and standard network detection.
It also co-opts FortiGate’s Apache mod_md/ACME components to establish a reverse shell, while impersonating FortiManager to access other devices. The report emphasises that the compromised management platform is the highest-value objective, with credentials and certificates effectively lost until rotated.