Palo Alto Networks Unit 42 has traced a prolonged intrusion at a telecommunications managed service provider, beginning September 2024, that ended in a memory-resident implant nobody had seen before. The actor, tracked as CL-STA-0954, first exploited CVE-2024-47575 — FortiJump — to compromise a FortiManager appliance, walking off with running configs, cryptographic trust material, and database files covering more than 500 managed FortiGate firewalls across the provider’s own infrastructure and its clients’ networks.
That haul bought the access for everything after. Using stolen credentials and a privileged foothold, the attackers later exploited CVE-2025-61624, a path traversal flaw in the FortiOS command line that Fortinet rates Medium at CVSS 6.0 and patched in April 2026. Exploiting it needs local access and high privileges already in hand, which the FortiManager archive supplied.
PEERSTITCH itself leaves no binary on disk, opens no listening ports, and makes no outbound connections. It injects into two legitimate FortiOS daemons, miglogd and iked, and builds a communication bridge between them inside process memory. When a VPN session arrives carrying the attacker’s marker, the iked hook takes an alternative path and skips FortiOS’s default validations — for that session alone. Unit 42 calls it resistant to conventional endpoint and network detection.
Fortinet’s fix is FortiOS 7.6.5 or 7.4.10 and above, with 7.2, 7.0, and 6.4 needing migration to a supported release. FortiProxy, FortiSwitchManager, and FortiPAM have their own fixed builds, and a virtual patch shipped in FMWP database update 25.120.
Source: The Hacker News
