FortiJump Breach Enables PEERSTITCH to Hijack 500+ Firewalls via Stolen Credentials

Organizations relying on FortiGate firewalls managed through a compromised FortiManager face significant exposure after a prolonged intrusion. According to Unit 42, attackers breached a telecommunications managed service provider in September 2024, exposing configurations and cryptographic material tied to more than 500 managed firewalls. This breach allowed the threat group, tracked as CL-STA-0954 or UNC5820, to steal sensitive cryptographic material and administrative credentials.

The attackers initially exploited CVE-2024-47575, known as FortiJump, to access the management channel on TCP port 541. They registered a rogue virtual appliance and exfiltrated a configuration archive named .tm. This archive contained running configurations, network topology details, encrypted credentials, certificates, and private keys. Unit 42 confirmed that administrative and SSL/VPN passwords were recoverable from these stolen files, enabling further unauthorized access.

Exploitation and Implant Deployment

Using the stolen credentials, attackers established unauthorized VPN sessions from infrastructure including IP addresses 23.240.77[.]233 and 47.18.167[.]159. They also pushed packet-capture configurations to managed firewalls to intercept HTTP traffic and monitor services such as TFTP, RADIUS, and LDAP. This activity supported credential interception and internal reconnaissance. To maintain persistence, the group deployed PEERSTITCH, a memory-resident ARM64 implant, using CVE-2025-61624, a privileged path-traversal flaw in Fortinet’s command-line interpreter.

PEERSTITCH hijacks legitimate FortiOS processes, leaving no persistent executable on disk, opening no listening ports, and initiating no outbound connections of its own. Although the initial staging involved downloading files to /data2/template/, the injector deleted its executable after installation. The C-based injector, named lldprx, targeted /bin/miglogd and /bin/iked. This fileless approach makes detection difficult, as the malware operates entirely within system memory.

Who is affected

The intrusion targeted a telecommunications managed service provider. More than 500 FortiGate firewalls were exposed due to the breach of the centralized FortiManager appliance. Researchers did not investigate customer networks directly, so the extent of downstream compromises remains unconfirmed. However, the theft of private keys and administrative passwords suggests that any user relying on these credentials for VPN access or device management is at risk.

Our take on the response

The use of a memory-resident implant that hides within legitimate system processes complicates detection efforts. Traditional signature-based scanning may fail to identify PEERSTITCH because it does not create files or open ports. Organizations should monitor for unusual process behavior or unauthorized configuration changes, particularly packet-capture rules. The fact that attackers could recover plaintext passwords from stolen configurations highlights the critical importance of rotating credentials and revoking compromised certificates immediately after a breach.

For customers and users

If you manage FortiGate devices, review your FortiManager access logs for unauthorized virtual appliances or unexpected configuration exports. Check whether any packet-capture rules were enabled without your approval, as these can intercept sensitive traffic. Rotate all administrative passwords and SSL/VPN credentials that may have been stored in configuration archives. Look for follow-up phishing emails that reference this breach to trick staff into revealing new credentials or installing malware.

Background: VPNs

A virtual private network encrypts your internet traffic and routes it through a remote server. This masks your real IP address from the sites you visit. It protects data on public Wi-Fi but does not make you anonymous to the VPN provider itself.

Read the full guide: How VPNs Actually Work: A Plain English Explanation of Virtual Private Networks

What to do and how to stay safe: FortiGate

• Audit FortiManager logs for unauthorized virtual appliance registrations or configuration exports.
• Rotate all administrative and VPN passwords that were stored in device configurations.
• Review firewall rules for unauthorized packet-capture configurations targeting sensitive protocols.
• Monitor for new login attempts from unfamiliar IP addresses or geographic locations.

Step-by-step guide: How to Stop Ransomware: 3 Layers That Actually Work

General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is PEERSTITCH?

PEERSTITCH is a memory-resident ARM64 implant that hijacks legitimate FortiOS processes without creating persistent files or opening network ports.

Which vulnerabilities were exploited?

Attackers used CVE-2024-47575 (FortiJump) for initial access and CVE-2025-61624, a path-traversal flaw, to deploy the implant.

Were customer networks directly compromised?

Researchers did not investigate customer networks, so downstream compromises have not been confirmed.