When the Firewall Manager Becomes the Way In: Notes on the PEERSTITCH FortiGate Implant

Central management consoles make life easier: one place to push policy, firmware and credentials to hundreds of firewalls. A report published by Palo Alto Networks Unit 42 on October 14, 2026, shows the other side of that convenience. When one console holds the configuration and secrets of every firewall, compromising that console exposes all of them.

What happened

In September 2024, attackers used FortiJump (CVE-2024–47575, CVSS 9.8) to get into the FortiManager of a telecommunications managed service provider. They registered a rogue virtual FortiGate and, within minutes, pulled an archive with configurations, credentials and trust material for more than 500 managed FortiGate firewalls. They cracked the reversibly encrypted passwords, opened SSL VPN sessions from external infrastructure, and then used CVE-2025–61624, a path traversal in the FortiOS auto-script engine, to write files as root and deploy a new implant called PEERSTITCH. CISA added CVE-2025–61624 to its Known Exploited Vulnerabilities catalog on October 16, 2026.

Why the implant is hard to spot

PEERSTITCH is an ARM64 binary that injects into two FortiOS daemons, the logging process and the IPsec VPN daemon. It deletes itself after running, opens no ports and makes no outbound connections. Tagged VPN sessions take an alternate code path that skips FortiOS security checks. Tools that only scan files on disk will not see it.

A practical checklist

• Upgrade FortiOS to 7.6.5 or 7.4.10 and later; every 7.2, 7.0 and 6.4 release is affected and needs to move to a fixed branch.
• Update FortiProxy, FortiSwitchManager and FortiPAM according to advisory FG-IR-26–122.
• Expose FortiManager's TCP 541 only to your own firewalls and review the device list for unknown entries.
• If the manager was exposed, rotate credentials, certificates and FGFM trust material on every managed device. Patching does not invalidate stolen keys.
• Look for auto-script objects containing ../ and for Signal 11 crashes of miglogd or iked in the crash log.
• Forward firewall logs to a central system in real time; the attackers wiped local logs.

The broader lesson

A management plane is a high-value asset in its own right. Keep it on an isolated network, reachable only from known sources, and monitor it as closely as the systems it controls.

The full write-up with affected versions and detection notes is here: https://symantecland.com/fortigate-peerstitch-implant-fortimanager-breach/?utm_source=medium&utm_medium=article&utm_campaign=sx_syndication

— Kazem Mortazavi, independent network-security consultant