Palo Alto Networks’ Unit 42 threat intelligence team uncovered a multistage cyber intrusion against a telecommunications managed service provider in September 2024, in which attackers exploited the FortiManager vulnerability CVE-2024-47575 to steal configurations, credentials and cryptographic material associated with more than 500 managed FortiGate firewalls. The attackers used the compromised management appliance to gather network topology information, intercept traffic, establish unauthorized virtual private network (VPN) sessions and maintain access to the targeted environment.
Unit 42 said the stolen information exposed the provider’s infrastructure and the networks of its clients, although its investigation did not confirm intrusions into those client networks. The investigation also identified Peerstitch, a previously undocumented ARM64 malware implant that attackers deployed by exploiting a separate FortiOS privilege-escalation vulnerability, CVE-2025-61624. The malware operates in memory, leaves no persistent binary on disk and opens no listening ports, instead using legitimate processes on compromised firewalls to conceal its activity and bypass conventional detection.
The researchers highlighted that the attackers also established a command-and-control channel through FortiGate’s Apache module and impersonated the management platform to retrieve configurations from additional firewalls. The findings highlight the risks of compromising centralized network management systems, where stolen credentials and cryptographic trust material can enable access beyond the initially compromised appliance.
Following initial compromise, the attackers behind CL-STA-0954 demonstrated a complex level of tradecraft. Aspects of the post-exploitation activity overlap with intrusions attributed to suspected nation-state actors. Armed with the stolen information, the attackers maintained long-term access, intercepted network traffic, established VPN sessions, deployed backdoors, and exploited a separate privilege-escalation vulnerability.
“The attackers exploited another vulnerability, CVE-2025-61624, via FortiOS auto-script path traversal. This exploit facilitated the deployment of Peerstitch, a novel, memory-resident ARM64 malware,” Unit 42 detailed in the recent blog post. “Peerstitch leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections. Instead, it communicates through traffic generated by legitimate processes on the infected host, which makes the malware resistant to conventional endpoint and network detection. The attackers also impersonated the FortiManager platform to pull from managed firewalls of other hosts in the targeted network.”
The attackers gained initial access by exploiting a vulnerability in the company’s central FortiManager appliance, which allowed an unauthenticated remote attacker to run arbitrary commands through its management channel. Once inside, they registered a rogue virtual firewall device to the central FortiManager instance from infrastructure they controlled, and they later changed the source of that infrastructure.
Immediately after registering the rogue device, the attackers generated a configuration archive on the FortiManager system and exfiltrated it shortly afterwards. Analysis of the archive showed that it contained the FortiManager appliance’s own identifying details and its management relationships with every enrolled device. It also held the complete running configurations for more than 500 managed firewalls across internal infrastructure and client networks.
The archive included central management databases, which covered administrative domains, global objects, policy packages, and device revision metadata. It also contained an inventory of more than 500 firewalls alongside their public IP addresses, as well as internal network topology maps, routing tables, and interface configurations. Finally, the attackers obtained encrypted administrative, local, and VPN credentials, along with cryptographic trust material, including public certificates and private keys.
“Following an extended dwell period, the attackers pivoted to active network reconnaissance. They used the compromised FortiManager device to push unauthorized sniffer configurations to multiple downstream managed FortiGate firewalls,” the Unit 42 researchers mentioned. “The packet captures targeted unencrypted HTTP traffic and 11 specific services over different TCP ports to intercept sensitive communications and map network perimeters.”
In a later phase of reconnaissance, the attackers deployed additional packet-capture rules on the core perimeter firewalls. These rules targeted three types of traffic. The first was TFTP traffic, which allowed them to capture files, communications, firmware, and configuration data. The second was RADIUS and RADIUS-Accounting traffic, which allowed them to sniff network authentication activity. The third was LDAP traffic, which allowed them to intercept Active Directory queries and enumerate the directory.
Unit 42 researchers disclosed that the attackers took extensive measures to eliminate forensic evidence of their activity. They halted both local and remote logging on the compromised devices before running their malicious scripts, and they cleared crash logs that were generated during their early attempts to inject code into memory. Shortly after the scripts ran, they also automatically deleted the rogue administrator accounts, rogue VPN groups, and script objects they had created.
To further conceal their presence, the attackers overwrote a legitimate configuration file with a common string found in that file, which masked the files they had used to set up a remote shell. One of their tools also deleted its own binary from disk and terminated the setup process that had launched it before exiting.
The logging data also showed intermittent drops on the tunnel management interface during periods of malicious activity. The analysts assess with medium confidence that the attackers deliberately caused this degradation to suppress real-time telemetry to the central management consoles. This is consistent with the other suppression measures they used, including stopping logging services, clearing crash logs, and rolling back configuration objects. It is possible that the attackers forced these disconnects by exploiting a second vulnerability in the management channel. However, the available logs did not capture the triggering traffic, so the analysts could not confirm the mechanism.
In conclusion, the post noted that this intrusion highlights a growing threat, with weaponization of centralized edge management ecosystems to compromise downstream networks. One compromised appliance yielded the cryptographic keys, credentials and network topology for more than 500 firewalls, including devices protecting client organizations.
“The discovery of the Peerstitch implant demonstrates the increasing technical maturity of edge-device malware,” Unit 42 researchers said. “By operating as a one-shot injector, avoiding persistent disk artifacts and building a covert inter-process communication bridge inside process memory, the attackers achieved sustained persistence while evading traditional monitoring.”
For organizations that manage infrastructure on behalf of others, the management platform is the highest-value target on the network. Compromising the management platform is not contained by the boundary of the organization that owns it. That compromise also does not end when the platform is patched.
They added that the cryptographic trust material governing the platform’s relationship with every managed device leaves with the attacker and remains valid until it is rotated. Defenders must treat edge management interfaces with the highest level of zero trust isolation. They must also treat the credentials and certificates those interfaces hold as compromised the moment the platform is.
Last week, the Federal Bureau of Investigation (FBI) and the U.S. Secret Service (USSS) warned that the FortiBleed credential-compromise campaign continues to target internet-facing Fortinet FortiGate firewalls and secure socket layer (SSL) virtual private network (VPN) gateways, potentially locking organizations out of affected systems. The agencies identified that SOCRadar had verified more than 86,644 compromised devices across 194 countries. The campaign exploits reused or leaked credentials and legacy SHA-256 password storage to harvest and crack authentication data at scale, while attackers continue scanning exposed Fortinet firewalls using previously obtained credentials.
