PEERSTITCH malware: How attackers compromised 500 Fortinet firewalls via FortiManager discusses a multi-stage intrusion disclosed by Palo Alto Networks Unit 42. The operation began in September 2024 when attackers exploited CVE-2024-47575 (FortiJump) to unauthorisedly register a rogue virtual device with a central FortiManager appliance over TCP port 541.
From a single compromised FortiManager, they exfiltrated a configuration archive containing running configurations, serial numbers, public IPs, routing tables, VPN credentials and cryptographic material for more than 500 downstream FortiGate firewalls. The breached platform effectively granted access to the networks of the target’s managed services provider and its clients; the scope was limited to the provider’s environment, not all downstream customers.
In the second stage, the attackers used CVE-2025-61624 (FortiOS auto-script engine path traversal) to deploy a stealthy implant named PEERSTITCH. The 64-bit ARM64 binary operates without persisting on disk, opening ports or initiating outbound connections; it hides communications by piggybacking on legitimate FortiOS processes (logging and VPN service) and creates a covert memory-based bridge.
The malware can exfiltrate data by writing a session token into the VPN daemon’s memory via /proc, enabling authorised-looking sessions that bypass FortiOS checks. The attackers also abused Apache’s certificate management module to establish an outbound reverse shell. Defenders are warned that patching FortiManager does not revoke the stolen credentials or certificates; trust material remains valid until individually rotated. The incident highlights how a compromised management platform can become a supply-chain-wide breach affecting hundreds of networks.