PEERSTITCH Implant Abused FortiManager CVE-2024-47575 to Expose 500 Firewalls

Palo Alto Networks Unit 42 documented a multi-stage intrusion against a telecommunications managed service provider that began in September 2024. The attackers compromised a central FortiManager appliance, using it as a pivot point to extract sensitive data from hundreds of downstream firewalls.

What happened

The intrusion relied on CVE-2024-47575, known as FortiJump, which permitted unauthenticated attackers to register a rogue virtual device with the central management platform over TCP port 541. According to Palo Alto Networks, this initial compromise allowed the threat actors, tracked as cluster CL-STA-0954, to establish a foothold within the managed service provider’s infrastructure.

Within minutes of registering the rogue device, the attackers extracted a configuration archive containing serial numbers, public IP addresses, routing tables, and cryptographic trust material. This data covered more than 500 managed FortiGate firewalls that protected both the provider’s own infrastructure and the networks of its clients.

Using decrypted credentials from the stolen files, which stored passwords as reversible ciphertext, the attackers established unauthorized SSL/VPN sessions into internal network management segments. They connected from external staging addresses, leveraging the stolen keys to bypass standard authentication controls and gain persistent access to critical network segments.

Why it matters

The breach exposed not only the managed service provider but also its downstream clients, whose firewall configurations and private keys were exfiltrated without their knowledge. Unit 42 noted that the investigation covered only the provider’s environment, leaving the full impact on client networks unknown.

The deployment of PEERSTITCH, a stealthy implant designed to evade detection inside FortiOS memory, highlights the sophistication of the operation. This malware helped attackers maintain access long after the initial compromise, turning a single management appliance breach into a widespread exposure of hundreds of network perimeters.

What to watch

• Monitor for unauthorized device registrations on FortiManager consoles, especially those appearing from unexpected IP ranges or at unusual times.
• Review SSL/VPN session logs for connections originating from external addresses that do not match known management locations.
• Audit FortiManager configurations for any new virtual devices or policy changes that were not authorized by internal change management processes.
• Check for anomalies in FortiOS memory usage or process behavior that could indicate the presence of stealthy implants like PEERSTITCH.

Signals worth monitoring

Teams should prioritize monitoring for anomalous device registration events on central management platforms, as these often precede large-scale data exfiltration. Security operations centers typically look for sudden spikes in configuration archive downloads or unusual outbound traffic from management appliances to external staging servers. Checking for unauthorized SSL/VPN sessions established from non-standard IP addresses can reveal lateral movement. Containment usually involves isolating the compromised management system from the network to prevent further credential theft and revoking any cryptographic material that may have been exposed during the breach.

Background: Lateral movement

Monitor for unusual process chains like PowerShell spawning cmd.exe, off-hours remote execution via WinRM, and credential dumping artifacts. Correlate network flows with host logs to distinguish administrative work from attacker progression. Focus on the sequence of actions rather than isolated events.

Read the full guide: Detect Lateral Movement: Log Signals, Blind Spots and Detection Logic

What to do and how to stay safe: FortiManager

• Verify that FortiManager appliances are patched against CVE-2024-47575 or apply compensating controls to restrict access to TCP port 541.
• Rotate all cryptographic keys and passwords for managed firewalls if there is any suspicion that configuration archives were accessed.
• Implement strict network segmentation to limit the blast radius of management appliance compromises, ensuring they cannot directly initiate sessions into client networks.
• Once the vendor provides an update, deploy it immediately and conduct a forensic review of device registration logs for signs of rogue virtual devices.

Step-by-step guide: Social Engineering: How Manipulation Bypasses Technical Defenses

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What vulnerability did the attackers use to compromise the FortiManager appliance?

The attackers exploited CVE-2024-47575, also known as FortiJump, which allowed unauthenticated registration of rogue virtual devices.

How many firewalls were exposed in this breach?

More than 500 downstream FortiGate firewalls were exposed, with their configurations and credentials exfiltrated.

What is PEERSTITCH?

PEERSTITCH is a stealthy implant deployed by the attackers to maintain access and evade detection within FortiOS memory.