Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

1. Executive summary

Unit 42 has published an investigation into a September 2024 intrusion against a telecommunications managed service provider in which attackers exploited CVE-2024-47575 (CVSS 9.8 CRITICAL, CWE-306, in CISA KEV since 2024-10-23, EPSS 95%) against a central FortiManager appliance, then exfiltrated an archive containing running configurations, cryptographic material and management databases covering more than 500 managed FortiGate firewalls belonging to the provider and its clients. The actor, tracked by Unit 42 as cluster CL-STA-0954 (also UNC5820), subsequently deployed PEERSTITCH, a memory-resident ARM64 implant that leaves no binary on disk, opens no listening ports and makes no outbound connections, communicating instead through traffic generated by legitimate processes on the host. The exposure described is configuration and credential material rather than confirmed intrusion into client networks, but that material is sufficient to impersonate the FortiManager platform, establish VPN sessions and pull configuration from managed firewalls. For EMEA financial services clients running FortiManager as a central management plane, the concentration risk is the story: one appliance compromise yields the management credentials and configuration of every enrolled device, including devices protecting third-party networks.

2. Regulatory framing

3. Technical analysis & attack chain

The chain below is what Unit 42 reports as observed. Steps 1 to 4 are described as confirmed by the investigating vendor; the attribution to a nation-state actor is the vendor's assessment and is not corroborated by a second source in the material available to us.

1. Initial access. The attackers exploited CVE-2024-47575 (FortiJump), an unauthenticated remote command execution flaw in the FortiManager FMG-Access management channel on TCP port 541. The verified reference data classifies this as CWE-306, missing authentication for a critical function, with CVSS 9.8 and CISA KEV entry dated 2024-10-23. Unit 42's write-up describes the same flaw as allowing crafted requests to that channel; the CWE-306 classification and the crafted-request description are consistent, and we use the verified classification.
2. Rogue device registration. During exploitation the attackers registered a Virtual FortiGate appliance to the central FortiManager instance under the name localhost, serial number FMG-VMTM23017412. The registration originated from external attacker infrastructure at 45.32.41[.]202, later changed to 198.199.122[.]22. This is the step that turns an unauthenticated RCE into a trusted management relationship.
3. Configuration archive theft. Immediately after registration the attacker generated a configuration archive named .tm in the FortiManager file system and exfiltrated it. The archive contained the FortiManager appliance's own serial number and its management relationships to every enrolled device, complete running configuration files for more than 500 managed FortiGate firewalls across internal and client networks, and the central management SQLite databases global.db (administrative domains, global objects, policy packages) and revinfo.db. The source text is truncated at this point and does not describe the full contents of revinfo.db; we do not speculate on what else it held.
4. Post-exploitation. Unit 42 reports that the actor used the stolen material to maintain long-term access, intercept network traffic, establish VPN sessions, deploy backdoors and exploit a separate privilege-escalation vulnerability. The attackers also impersonated the FortiManager platform to pull configuration from managed firewalls belonging to other hosts in the targeted network.
5. PEERSTITCH deployment. The second vulnerability, CVE-2025-61624, was exploited through a FortiOS auto-script path traversal to deploy PEERSTITCH, described as a novel memory-resident ARM64 implant. PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections. It communicates through traffic generated by legitimate processes on the infected host. That design defeats endpoint detection that relies on file artefacts and network detection that relies on new listening sockets or new egress flows.

Confidence caveats. The entire technical account rests on a single vendor report (Unit 42). The attribution to suspected nation-state actors is Unit 42's assessment based on tradecraft overlap; the verified reference data contains no MITRE ATT&CK profile for CL-STA-0954 or UNC5820, so we treat the attribution as unconfirmed. The CVE-2025-61624 identifier and the auto-script path traversal mechanism are single-sourced and should be verified against Fortinet's own advisory before you build detection or patch decisions on them. The victim is a telecommunications managed service provider; Unit 42 states it did not examine the client networks whose firewalls the provider managed, so the report describes exposure of configuration and credential material, not confirmed intrusion into those networks. Treat any claim that client networks were breached as unsupported by this source.

4. Mitigation & containment

P1, within 24 hours.

• Determine whether you run FortiManager, and whether it is exposed on TCP port 541 to any network you do not control. CVE-2024-47575 is in CISA KEV with a 2024-10-23 entry date and an EPSS of 95%; if the FMG-Access channel is reachable from untrusted networks, treat the appliance as compromised until you can show otherwise.
• On every FortiManager instance, enumerate registered devices and look for rogue or unexpected Virtual FortiGate registrations. The observed artefact is a device named localhost with serial FMG-VMTM23017412. Any registration you cannot account for is a P1 investigation.
• Check the FortiManager file system for an archive named .tm and for any unexpected archive creation in the period around the intrusion. If present, preserve it and treat the appliance's stored configuration and cryptographic material as disclosed.
• If you are a client of a managed network or firewall provider, ask the provider directly whether their FortiManager estate was affected and whether your devices were among the enrolled estate. You cannot answer this from your own telemetry.

P2, within 72 hours.

• Rotate credentials and cryptographic material that a FortiManager compromise would expose: device management credentials, VPN credentials and keys, and any secrets held in the running configurations of managed FortiGate devices. Rotation is required because the stolen archive contained running configurations and cryptographic material, not just topology.
• Review VPN session logs for sessions established from infrastructure you do not recognise, with attention to 45.32.41[.]202 and 198.199.122[.]22 as historical indicators. These are attacker infrastructure from September 2024 and are unlikely to still be in use, so absence of these addresses in current logs does not clear you.
• Apply the Fortinet fix for CVE-2024-47575 if you have not already. The source does not name a specific fixed version, so take the version from Fortinet's own advisory rather than from this note.
• For CVE-2025-61624, verify the identifier and the auto-script path traversal mechanism against Fortinet's advisory before acting. It is single-sourced here. If confirmed, review FortiOS auto-script configuration for entries you did not create.

P3, within 7 days.

• Restrict management-plane access so that FMG-Access on TCP port 541 is reachable only from a dedicated management network, not from general corporate or internet-facing ranges. This is the control that would have prevented step 1 regardless of patch state.
• Review whether your FortiGate estate depends on a single FortiManager instance and record that dependency in your third-party and concentration risk documentation. The DORA Art. 29 assessment in section 2 turns on this fact.
• Because PEERSTITCH is memory-resident and generates no independent network traffic, file-based and flow-based detection will not find it. Detection effort should go to the behavioural indicators in section 5 and to memory acquisition on any FortiGate device you believe was managed by a compromised FortiManager.

5. Indicators of compromise

The two IP addresses are attacker infrastructure observed in September 2024 and are almost certainly no longer in use. They are included for retrospective log review, not for blocking. The file names global.db and revinfo.db are legitimate FortiManager database files; their presence is not itself malicious and they are listed only because the source names them as the exfiltrated artefacts.

ipv4  45.32.41[.]202
ipv4  198.199.122[.]22
filename  .tm
device_name  localhost
serial  FMG-VMTM23017412
filename  global.db
filename  revinfo.db

Behavioural indicators. The source describes device registration and management-plane behaviour rather than atomic host indicators for PEERSTITCH itself.

6. Detection

The source does not publish file hashes, mutex names, command-line flags or hard-coded strings for PEERSTITCH. It does publish distinctive artefacts of the intrusion: the rogue device name, the serial number, the archive name and the two attacker addresses. A YARA rule built on those artefacts detects the intrusion's traces in logs and configuration dumps, not the implant binary itself, and is labelled accordingly.

rule CL_STA_0954_FortiManager_Rogue_Registration_Artifacts
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-15"
        reference = "https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/"
        description = "Detects artefacts of the CL-STA-0954 FortiManager intrusion in configuration dumps, logs and exported artefacts. This does not detect the PEERSTITCH implant, for which no file artefacts were published."
        confidence = "medium"
    strings:
        $serial = "FMG-VMTM23017412" ascii wide
        $ip1 = "45.32.41.202" ascii wide
        $ip2 = "198.199.122.22" ascii wide
        $db1 = "revinfo.db" ascii wide
        $db2 = "global.db" ascii wide
    condition:
        uint32(0) != 0x04034b50 and
        (
            $serial or
            any of ($ip*) or
            (2 of ($db*))
        )
}

The rule excludes ZIP archives at offset zero because .tm is described as a configuration archive and the database file names will legitimately appear inside FortiManager backup archives. Tune the exclusion to your own backup format.

title: FortiManager Rogue Virtual FortiGate Registration
id: 8f3c1a72-4d5e-4b91-9c2a-6e0f7b3d1a48
status: experimental
description: Detects registration of an unexpected Virtual FortiGate appliance to FortiManager, the step CL-STA-0954 used after exploiting CVE-2024-47575 to establish a trusted management relationship.
references:

    - https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
author: Adverse Trace
date: 2026-10-15
logsource:
    product: fortinet
    service: fortimanager
detection:
    selection_registration:
        action|contains:

            - 'add device'
            - 'register'
            - 'device add'
    selection_rogue:
        device_name: 'localhost'
    selection_serial:
        serial|contains: 'FMG-VMTM23017412'
    condition: selection_registration and (selection_rogue or selection_serial)
falsepositives:

    - Legitimate lab or test Virtual FortiGate appliances registered under the default name localhost. Baseline your environment before enabling alerting.
level: high

The Sigma rule depends on FortiManager log field names, which vary by FortiOS and FortiManager version. Field names above are indicative; map them to your log schema before deployment. The serial number match is the higher-fidelity condition of the two.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• Unit 42, Palo Alto Networks, "Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant", https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/, published 2026-10-14.

This is the only source available for this advisory. Every technical claim in sections 3, 5 and 6 derives from it. The CVE-2024-47575 severity, CWE classification, CISA KEV status and EPSS value come from the verified reference data supplied with this item, not from the source.

8. Adverse Trace position

We assess CVE-2024-47575 as the controlling risk in this item: CVSS 9.8, CWE-306, in CISA KEV since 2024-10-23, EPSS 95%, and exploited here to convert a single unauthenticated request into management-plane control of an estate exceeding 500 firewalls. The PEERSTITCH implant is technically notable but it is the second-stage payload; the damage was done at step 3, when configuration and cryptographic material left the appliance. For EMEA financial services clients, the exposure is concentrated in two places: firms running FortiManager as a central management plane, and firms consuming managed firewall or network services from a provider that does. The second group cannot assess its own exposure from its own telemetry and needs a direct answer from the provider. We treat the nation-state attribution as unconfirmed because the verified reference data carries no MITRE ATT&CK profile for CL-STA-0954 or UNC5820, and we treat CVE-2025-61624 and the PEERSTITCH mechanism as single-sourced pending Fortinet's own advisory. Adverse Trace will verify the CVE-2025-61624 identifier and the FortiOS auto-script path traversal against Fortinet's advisory, and will issue a follow-up if the mechanism or the affected versions differ from what Unit 42 has published. Clients who run FortiManager and want the rogue-registration check run against their own device inventory should contact their Adverse Trace handler.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.