PEERSTITCH Malware Compromises 500+ Firewalls via FortiManager Exploits

• •Over 500 FortiGate firewalls compromised through FortiManager exploitation.
• •PEERSTITCH malware operates stealthily, evading traditional detection methods.
• •Attackers exploited CVE-2024-47575 and CVE-2025-61624 to gain access and deploy malware.

In September 2024, a multi-stage network intrusion targeted a telecommunications managed service provider, leading to the compromise of over 500 FortiGate firewalls. The attackers exploited CVE-2024-47575, a critical vulnerability in FortiManager, to gain unauthorized access and exfiltrate sensitive configuration data. Following this, they deployed PEERSTITCH, a novel memory-resident ARM64 malware, by exploiting CVE-2025-61624, a path traversal flaw in FortiOS. PEERSTITCH operates stealthily, leaving no persistent binaries and communicating through legitimate process traffic, making it difficult to detect. The attackers maintained long-term access and could intercept network traffic and establish unauthorized VPN sessions. The investigation by Palo Alto Networks' Unit 42 revealed that the compromised configurations included sensitive data such as routing tables and VPN credentials. The incident highlights significant vulnerabilities in Fortinet's management systems and the potential for widespread impact on client networks. Current protective measures include advanced security products from Palo Alto Networks.