Key points
- Intruders exploited CVE-2024-47575 in FortiManager to steal configurations and keys for over 500 firewalls.
- A separate flaw, CVE-2025-61624, allowed deployment of Peerstitch, a memory-resident ARM64 implant.
- The malware evades detection by leaving no disk files, opening no ports and using legitimate processes.
The short version
- A telecommunications managed service provider suffered a multi-stage intrusion in September 2024.
- Threat actors used stolen data to intercept traffic and create unauthorized virtual private network sessions.
- Palo Alto Networks Unit 42 identified the campaign and linked it to two distinct software vulnerabilities.
The details
Palo Alto Networks Unit 42 reported that attackers compromised a telecommunications managed service provider in September 2024. The intruders exploited a vulnerability in FortiManager, tracked as CVE-2024-47575. This initial breach allowed them to extract configurations, credentials and cryptographic material. According to Unit 42, the stolen data covered more than 500 managed FortiGate firewalls.
The attackers then used the compromised management appliance to map network topology. They intercepted traffic and established unauthorised virtual private network sessions to maintain access. Although the investigation exposed the provider’s infrastructure and client networks, Unit 42 stated it did not confirm intrusions into those client environments.
The threat group, designated CL-STA-0954, demonstrated complex tradecraft reminiscent of suspected nation-state actors. They leveraged the stolen credentials to impersonate the management platform. This deception enabled them to retrieve configurations from additional firewalls. The group also established a command-and-control channel through the FortiGate Apache module. This activity highlights the significant risk of compromising centralised network management systems. Stolen trust material can facilitate access far beyond the initially breached appliance.
The context
Unit 42 identified a previously undocumented malware implant named Peerstitch. The attackers deployed this software by exploiting a separate FortiOS privilege-escalation vulnerability, CVE-2025-61624. According to the report, the exploit used an auto-script path traversal method. Peerstitch is an ARM64 implant designed to operate entirely in memory.
It leaves no persistent binary on the disk and opens no listening ports. The malware initiates no outbound network connections. Instead, it uses legitimate processes on the compromised firewalls to conceal its activity. This technique allows it to bypass conventional detection methods that rely on file system monitoring or network traffic analysis.
Defender's checklist
Organisations using FortiManager should verify their appliances are patched against CVE-2024-47575. Administrators must review access logs for unauthorised configuration downloads or topology queries. Networks should monitor for unusual virtual private network session establishments. Security teams should check FortiGate appliances for signs of CVE-2025-61624 exploitation. Analysts should look for processes running in memory without corresponding disk files. Review Apache module activity on FortiGate devices for unexpected command-and-control patterns.
If your data is involved
If you rely on a managed service provider for network security, contact their support team to confirm whether your infrastructure was affected. Ask whether they have rotated cryptographic keys or credentials that may have been exposed. Monitor your accounts for unauthorised access or unusual login locations. Be vigilant for phishing attempts that reference this incident, as scammers often exploit recent breaches to steal further data. Verify the authenticity of any communication claiming to be from your provider before clicking links or downloading attachments.
Background: Phishing
Phishing is a broad, automated attack sent to thousands of recipients using generic templates. Spear phishing targets specific individuals or organisations using researched personal details. The core difference lies in the level of personalisation. You defend against phishing with technical filters and against spear phishing with verification protocols and human awareness.
Read the full guide: Phishing vs Spear Phishing: Targeting Mechanics and Defence
What to do and how to stay safe: FortiGate
- Verify that all FortiManager and FortiGate appliances are updated to versions that address the cited vulnerabilities.
- Audit recent configuration changes and access logs on network management consoles for unauthorised activity.
- Rotate any cryptographic material or credentials that were stored on the compromised management appliances.
- Monitor network traffic for unexpected virtual private network sessions or connections to unknown command-and-control servers.
Step-by-step guide: Security Awareness Training Mistakes That Leave Gaps Open
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What vulnerabilities were exploited in this breach?
Attackers exploited CVE-2024-47575 in FortiManager and CVE-2025-61624 in FortiOS.
Was client data directly stolen?
Unit 42 stated the investigation did not confirm intrusions into client networks.
What is Peerstitch?
It is a memory-resident ARM64 malware that leaves no disk files or listening ports.
