Malware · Vulnerabilities
Unit 42 finds PEERSTITCH malware targeting over 500 Fortinet firewalls
Researchers at Unit 42 discovered attackers used a Fortinet vulnerability to steal configurations and credentials from over 500 firewalls, then deployed advanced malware called PEERSTITCH.
Ross Grant3 min read
The short version
Researchers found that attackers broke into a system used to manage hundreds of Fortinet firewalls. They stole sensitive configuration files and passwords, then installed advanced malware to keep control. The attack used a software flaw that Fortinet customers should patch. Only one security team has reported this so far, so the full impact is not yet known.
By the numbers
- 500+firewalls with stolen configurationsUnit 42
- 2CVE vulnerabilities exploited (CVE-2024-47575, CVE-2025-61624)Unit 42
What happened?
Unit 42 researchers found that attackers exploited a vulnerability (CVE-2024-47575) in Fortinet's FortiManager to steal configuration data and credentials from over 500 managed firewalls. The attackers then deployed a memory-resident malware implant called PEERSTITCH. Only Unit 42 has reported this so far.
Attackers exploited a Fortinet vulnerability to steal firewall data
Researchers at Unit 42 have reported a sophisticated attack on a telecommunications managed service provider. The attackers exploited a vulnerability tracked as CVE-2024-47575 in Fortinet's FortiManager, which is used to centrally manage FortiGate firewalls. This allowed them to execute commands without needing to log in. The attackers registered a fake FortiGate device and used it to extract a configuration archive from the FortiManager system. This archive contained sensitive information about more than 500 managed firewalls, including configuration files, network maps, public IP addresses, and encrypted credentials. The attackers also obtained cryptographic keys and administrative data.
How the attackers moved deeper into the network
After stealing the configuration data, the attackers carried out further reconnaissance. They pushed unauthorised sniffer configurations to managed FortiGate firewalls. These sniffers captured unencrypted network traffic and targeted specific services to map out the network and intercept sensitive communications. The attackers focused on protocols such as HTTP, TFTP, RADIUS, and LDAP, which can carry authentication and directory information.
Credential cracking and further access
The stolen configuration files included credentials stored in a way that could be reversed. Unit 42 confirmed that administrative and VPN passwords could be recovered by brute-forcing the encrypted data. With these credentials, the attackers established VPN sessions to internal firewalls, giving them access to sensitive network segments. They also exploited another vulnerability (CVE-2025-61624) to escalate their privileges from admin to root on the firewalls, allowing them to run code with the highest level of access.
Deployment of the PEERSTITCH malware
Using their elevated access, the attackers deployed a new malware implant called PEERSTITCH. This is a 64-bit ARM64 executable designed to run in memory on FortiGate firewalls. It targets two key FortiOS processes: the logging daemon and the VPN service. The malware injects code into these processes, giving attackers a stealthy way to monitor network activity and maintain control. The implant is delivered through a series of scripts and binaries downloaded from attacker-controlled servers. It uses advanced techniques to attach to running processes and inject its payload directly into memory, making it harder to detect.
What Fortinet customers should do
The attack described by Unit 42 shows the risks of centralised firewall management and the importance of patching known vulnerabilities. Organisations using FortiManager and FortiGate devices should review their configurations, check for unauthorised devices or changes, and update to the latest security patches. If credentials may have been exposed, they should be reset. Monitoring for unusual VPN sessions or configuration changes can help spot similar attacks.
What is still unclear
So far, only Unit 42 has reported this attack. Their investigation focused on the managed service provider's own environment, not on the client networks whose firewalls were managed. It is not yet clear whether attackers accessed those client networks or how many end customers may be affected. Further confirmation from Fortinet or other sources may clarify the full scope.
Claimed vs confirmed
- Confirmed
Attackers accessed over 500 firewalls and deployed PEERSTITCH malware via FortiManager.
Unit 42 investigated and reported the attack, including technical details of the malware and the vulnerabilities used.
- Unconfirmed
Client networks managed by the provider were compromised.
Unit 42 did not examine client networks and did not confirm direct compromise beyond the provider's own environment.
The impact
- Money
- If regulators find customer data was exposed, fines could reach up to €20m or 4% of annual turnover under EU GDPR. No direct financial loss has been reported yet.
- Reputation
- A breach of central firewall management can damage trust in managed service providers and Fortinet products, especially if client networks are later found to be affected.
- Customers
- Customers whose firewalls were managed by the provider may be at risk if their configurations or credentials were exposed. They should monitor for suspicious activity and reset credentials if advised.
Why it matters
This attack shows how a single vulnerability in a central management system can put hundreds of networks at risk. Organisations using Fortinet products should check their systems and update them to prevent similar breaches. The attackers' methods also highlight the importance of strong credential management and monitoring.
How does it work?
CVE-2024-47575 allows remote attackers to execute commands on FortiManager without authentication. Attackers registered a rogue device to extract firewall configurations and credentials. They later used another flaw to escalate privileges and install the PEERSTITCH malware, which injects code into core firewall processes.
Key points
- Attackers exploited a Fortinet vulnerability to steal data from over 500 firewalls.
- They used stolen credentials to access internal networks and escalate privileges.
- The PEERSTITCH malware was deployed to maintain stealthy control.
- Only one security research team has reported this so far.
- Organisations should patch, reset credentials, and monitor for unusual activity.
Sources
Unit 42
Research
- Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant (opens in a new tab)
unit42.paloaltonetworks.com
- Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant (opens in a new tab)
