PEERSTITCH Malware Exploits FortiOS Vulnerabilities in Telecom Sector

• •Attackers exploited CVE-2024-47575 to compromise a telecom provider.
• •PEERSTITCH malware uses CVE-2025-61624 for stealthy operations.
• •Sensitive data from over 500 FortiGate firewalls was exfiltrated.

In September 2024, a telecommunications managed service provider was compromised through a multi-stage network intrusion tracked as CL-STA-0954. Attackers exploited CVE-2024-47575, a critical vulnerability in FortiManager, to gain initial access and exfiltrate sensitive configuration data from over 500 managed FortiGate firewalls. The attackers later deployed PEERSTITCH, a novel memory-resident ARM64 malware, using CVE-2025-61624, a path traversal flaw in FortiOS. PEERSTITCH operates stealthily, leaving no persistent files and communicating through legitimate processes, making detection difficult. The incident highlights significant risks to organizations using Fortinet appliances, especially those in the telecommunications sector. Current protective measures include Palo Alto Networks' advanced security products. The vulnerabilities have been patched, but exploitation in the wild has been confirmed.