Unit 42 has unpicked a two-year intrusion at a telecoms provider. It began in September 2024 with FortiJump, a missing-authentication FortiManager flaw. One stolen archive held configs, credentials and private keys for 500-plus managed FortiGate firewalls: the provider's own and its clients'.
The implant found there, PEERSTITCH, lives only in memory. No disk file, no listening port, no outbound connection; it talks through legitimate FortiOS processes. The second flaw was patched in April, yet CISA listed it as exploited on 16 October. Patching closes the door; the stolen keys still work until someone rotates them.
https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
Unit 42Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate ImplantWe investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware.