Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

What it is

PEERSTITCH is a memory-resident Linux ARM64 implant for FortiOS, found by Unit 42 in a September 2024 intrusion at a telecom managed service provider (cluster CL-STA-0954, aka UNC5820). Unit 42 says the post-exploitation tradecraft overlaps with intrusions attributed to suspected nation-state actors. The entry point was CVE-2024-47575 on a central FortiManager. From it the attackers took running configs, credentials and private keys for more than 500 managed FortiGates, including client firewalls.

How it works

1. Initial access. An unauthenticated attacker sends crafted requests to the FMG-Access channel (TCP 541). The attackers registered a rogue Virtual FortiGate named localhost (serial FMG-VMTM23017412) from 45.32.41[.]202, later 198.199.122[.]22. They then built a config archive named .tm and exfiltrated it.
2. Credential recovery. Passwords in the configs are stored as reversible ciphertext. Unit 42 brute-forced admin and SSL/VPN passwords from the stolen files. The attackers used legitimate credentials for SSL/VPN sessions from 23.240.77[.]233 and 47.18.167[.]159.
3. Sniffing. After a long dwell period, the attackers pushed sniffer configs through FortiManager. These captured HTTP and 11 other services, then TFTP (UDP 69), RADIUS (UDP 1812/1813) and LDAP (TCP 389) on core perimeter firewalls.
4. Root. CVE-2025-61624 is a path traversal in the CLI system.auto-script engine. The object name is not sanitized, so an authenticated admin, even a super_admin, can write a script anywhere as root. The attackers used the name ../../../../setup.
5. Implant delivery. The script fetched five files from hxxp[:]//23.240.77[.]233:8085/ into /data2/template/. The injector was saved as lldprx.
6. Injection. lldprx finds /bin/miglogd and /bin/iked through /proc, attaches with PTRACE_SEIZE, and maps a 16 KB RWX region. It writes a 1,344-byte payload, NOPs three offsets and writes a 20-byte trampoline. The two daemons pass tags to each other by writing to /proc/<pid>/mem, looking for the markers 8550 and 169.254.0.1 in traffic. When iked finds a matching tag, it skips default FortiOS security validation.
7. Second C2 path. An auto-script wrote ../../tmp/apache2/conf/md-acme.conf. It points Apache mod_md at an attacker ACME server, maps MDChallengeDns01 to /bin/node, and sets MDRenewMode always. Shell commands injected into the challenge domain name give a repeating SSH reverse shell to 23.240.77[.]233:8084.
8. Management impersonation. An admin account named FortiGateCloud pulled full configs over FGFM (TCP 541), although the victim had no FortiManager Cloud tenant.

flowchart TD
    A[Stolen FortiManager serial and trust material] --> B{How was FortiManager impersonated?}
    B -->|Path 1| C[CVE-2024-26009 FGFM auth bypass]
    B -->|Path 2| D[Reuse exfiltrated trust material]
    C --> E[FortiGateCloud account pulls configs]
    D --> E

What to do

Unit 42's detection table, hashes and YARA rule were not in the page text available here, so take them from the original report. The page does support these checks:

• Look on FortiGates for auto-script objects with traversal names (../../../../setup, ../../tmp/apache2/conf/md-acme.conf).
• Look for files in /data2/template/ (index.js, index.wasm, ipssem.js, lldprx) and for an md-acme.conf that sets MDChallengeDns01 to /bin/node.
• Look for a FortiGateCloud admin account on devices with no FortiGate Cloud enrollment.
• Look for unexpected sniffer configs, and for gaps in logs or in the tunnel management interface.
• Check for the commands the attackers ran to hide their work:

killall -9 miglogd
killall -9 syslogd
diagnose debug crashlog clear

• Check FortiManager for a device named localhost and for a .tm archive.
• Review SSL/VPN logins and FGFM traffic from the IPs above.
• Rotate every credential, certificate and key held by FortiManager. Unit 42 says stolen trust material stays valid after patching until it is rotated.
• Palo Alto Threat Prevention signatures 95788 and 96788 cover CVE-2024-47575.

Caveats

• Unit 42 examined only the provider's environment, not the client networks. Client exposure is of config and credential material, not confirmed intrusion.
• The FGFM impersonation is a medium-confidence assessment. The evidence does not separate CVE-2024-26009 from direct reuse of stolen trust material.
• The use of CVE-2024-26008 to drop the management tunnel is possible but unconfirmed, because logs did not capture the traffic.
• Unit 42 rules out CVE-2025-59718, CVE-2025-59719 and the FG-IR-26-060 SSO issues, since they need FortiCloud SSO enrollment.
• The page gives no affected FortiOS or FortiManager version ranges. Check the Fortinet PSIRT advisories it lists.