An intrusion that began with a FortiManager vulnerability gave attackers access to configuration and cryptographic material for more than 500 managed FortiGate firewalls, according to a newly published Unit 42 investigation. The attackers later used a separate FortiOS flaw to deploy PEERSTITCH, a previously undocumented implant that operates in memory on ARM64 devices. The attack itself occurred in September 2024; the technical analysis was published this week.
Unit 42 investigated the environment of a telecommunications organization. The more than 500 firewalls were managed by the compromised FortiManager and included devices protecting the provider's infrastructure and client networks. This figure describes the scope of material in an exfiltrated archive; it does not mean investigators confirmed that every firewall was implanted or every client network was breached.
From management server to downstream devices
The initial compromise used CVE-2024-47575 against the centralized FortiManager. Attackers exfiltrated running configurations, databases and cryptographic trust material. That data gave them a map of managed devices and potential ways to impersonate management communications. Unit 42 says later activity included configuration pulls from managed firewalls, but the evidence did not establish which of two possible authentication paths the attackers used.
The implant stage relied on another vulnerability, CVE-2025-61624, in FortiOS's auto-script handling. An authenticated administrative account could abuse path traversal in an auto-script object name to write a script outside its intended directory with root privileges. Unit 42 says the attackers used this path to place a loader for PEERSTITCH. The original draft's suggestion that the vulnerability itself bypassed checks on tagged VPN sessions conflated the flaw with later implant behavior; the research describes a file path traversal route to privileged execution.
Why PEERSTITCH is difficult to spot
PEERSTITCH is a one-shot injector that patches the memory of FortiOS processes, including the logging daemon and the IKE/IPsec service. Unit 42 reports that it leaves no persistent binary on disk, opens no listening port and makes no direct outbound connection. Instead, it communicates through traffic generated by legitimate processes. The researchers also documented additional attacker tooling and activity, so those properties should not be read as proof that an affected device would leave no forensic trace at all.
For defenders, the management-plane breach is the central issue. Patching the entry point does not revoke trust material already copied from the server. Unit 42 recommends treating the management platform's credentials and certificates as compromised when they have been exposed, then investigating downstream devices and rotating material that could still authenticate to them. Its report contains technical hunting guidance and indicators, with the important limitation that these observations come from one investigated environment.