20 OCT 2026 — One hijacked FortiManager console handed attackers the running configurations of more than 500 FortiGate firewalls at a telecommunications managed service provider, and they later planted a backdoor on some of those firewalls that never touches the disk. Palo Alto Networks' Unit 42 described the intrusion in a report published on 14 October 2026, naming the implant PEERSTITCH. Two days later, the US Cybersecurity and Infrastructure Security Agency (CISA) added the Fortinet flaw used to install it, CVE-2025-61624, to its catalogue of exploited vulnerabilities.
The provider is not named. Unit 42 dates the intrusion to September 2024 and tracks the attackers as CL-STA-0954, which it says is also known as UNC5820.
A management console as the way in
The first step used CVE-2024-47575, the FortiManager bug that outside researchers nicknamed FortiJump. Fortinet's advisory, first published on 23 October 2024, rates it critical at 9.8 on CVSS version 3 and says it lets an unauthenticated remote attacker run code or commands on the appliance.
According to Unit 42, the attackers registered a rogue virtual FortiGate named "localhost" with the provider's central FortiManager, then built and stole an archive called .tm. It held complete running configurations for more than 500 managed firewalls, a list pairing their serial numbers with public IP addresses, network maps, encrypted administrator and VPN credentials, and private keys. The firewalls guarded both the provider's own systems and its clients' networks.
The registration came from 45.32.41[.]202. Mandiant recorded the same address in October 2024, when it first named UNC5820 and dated the earliest exploitation attempt it had seen to 27 June 2024. At that time Mandiant said it lacked the data to judge the group's motivation or location.
From stolen settings to root access
After what Unit 42 calls an extended dwell period, the intruders used the console to push packet-capture rules to downstream firewalls. Those rules targeted unencrypted web traffic and 11 named services, then RADIUS authentication, LDAP directory queries and TFTP file transfers on core perimeter devices.
The stolen configurations stored passwords as reversible ciphertext. Unit 42 says it proved the point itself, brute-forcing admin and SSL VPN passwords from the files. The attackers then logged in over SSL VPN with valid credentials.
CVE-2025-61624 is gated on valid administrator credentials. Fortinet's advisory FG-IR-26-122, published on 14 April 2026, describes a path traversal in the command line of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager that may let a privileged attacker write or delete arbitrary files. It marks the bug as known exploited. Unit 42 says the auto-script feature does not sanitise an object's name, so a name containing "../" sequences places the script anywhere on the file system, and the attackers used that to reach root on the underlying operating system. A FortiOS administrator, even a super_admin, normally has no shell at all.
Unit 42 does not say when in the long intrusion this step took place.
How PEERSTITCH hides
The traversal dropped a loader on selected firewalls, which fetched five files from attacker servers. The core is a statically linked ARM64 program written in C. It attaches to two FortiOS daemons, miglogd for logging and iked for IKE/IPsec VPN negotiation, writes code into a 16 KB block of memory in each and then deletes its own binary.
Inside the daemons, the hooks watch traffic already passing through them for two markers and pass session tags between the processes by writing to each other's memory. When iked later sees a VPN session carrying a matching tag, it takes an alternative path that bypasses default FortiOS security validations, Unit 42 says. The implant opens no listening ports and makes no outbound connections, so the researchers describe it as resistant to ordinary endpoint and network detection.
The group also turned the firewalls' Apache certificate module into a reverse shell by pointing it at an attacker-run ACME server and mapping the DNS challenge step to Node.js. It killed logging daemons, wiped crash logs and deleted its rogue accounts. Unit 42 assesses with medium confidence that it impersonated FortiManager to pull configurations from more firewalls, using an account named FortiGateCloud, even though the provider had no such cloud tenant.
What the report does not establish
Unit 42 examined the provider's own environment only. It did not look inside the client networks whose firewalls were managed, and it says what it found was stolen configuration files and credentials, with no confirmed break-in to those client networks. It does not attribute the activity to a country, saying only that some of the later tradecraft resembles intrusions linked to suspected nation-state groups.
The report also comes from a rival firewall vendor, and it closes by listing Palo Alto Networks products that it says protect against the activity. Its file hashes and network indicators can be checked independently.
What Fortinet customers should do
Fortinet's fixed releases for CVE-2025-61624 are FortiOS 7.6.5 and 7.4.10 or later. For FortiOS 7.2, 7.0 and 6.4, every version is affected and the advisory says to migrate to a fixed release. CISA's alert of 16 October added the bug alongside a BeyondTrust flaw. The catalogue entry carries a forensic-triage flag; under CISA's directive BOD 26-04, that sets expectations for when agencies must check whether attackers got in before the patch was applied.
Fortinet rates the flaw medium, at 6.0, and lists its attack type as authenticated. In this intrusion that requirement was no barrier. Unit 42 says the attackers were already logging in with legitimate credentials. Our CVSS 3.1 calculator shows how that requirement lowers a base score.
Unit 42's central warning is that patching the console does not undo the theft. The trust material linking a FortiManager to each managed device "leaves with the attacker and remains valid until it is rotated," the report says. Its hunting guidance suggests looking for anonymous 16,384-byte memory regions with read, write and execute permissions inside miglogd and iked, segmentation-fault entries in crash logs, and auto-script objects whose names contain "../../".
View author profile → · Editorial policy
