# Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

Attackers exploited FortiManager FortiJump and a FortiOS auto-script path traversal to deploy PEERSTITCH, a memory-resident ARM64 implant hijacking miglogd/iked on 500+ FortiGates.

- Payout: Real-world hack
- Severity: critical
- Program: Fortinet FortiManager/FortiOS
- Credited: Daniel Gott and Shawn Westfall
- Disclosed: 2026-10-14
- CVE: CVE-2024-47575, CVE-2025-61624
- Write-up quality: 9/10
- Original: https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
- Library page: https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-fortimanager-cve-2024-47575-peerstitch-malware
- Tags: domain:network impact:data-leak impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:linux technique:chained technique:reverse-engineering vuln:auth-bypass vuln:command-injection vuln:path-traversal vuln:rce

**Target:** FortiManager FMG-Access (TCP 541) and FortiOS CLI system.auto-script engine
**Root cause:** CVE-2024-47575 allows unauthenticated command execution via crafted FMG-Access requests; CVE-2025-61624 fails to sanitize the auto-script object name, letting traversal sequences write files as root anywhere on the filesystem.
**Steps:**
1. Register rogue Virtual FortiGate `localhost` (serial FMG-VMTM23017412) to FortiManager via CVE-2024-47575 from `45.32.41.202`
2. Generate and exfiltrate config archive `.tm` containing global.db, revinfo.db, 500+ FortiGate configs and trust material
3. Push sniffer configs to managed FortiGates capturing HTTP and ports 3696-3706, plus TFTP/RADIUS/LDAP
4. Brute-force ciphertext admin/SSL-VPN creds, log in via SSL-VPN from `23.240.77.233`
5. Create auto-script object named `../../../../setup` to drop loader outside intended dir (CVE-2025-61624)
6. Loader downloads `pM.js`, `index.js`, `index.wasm`, `ipssem.js`, `lldprx` from `hxxp://23.240.77.233:8085/` into `/data2/template/`
7. `lldprx` ptrace-seizes `/bin/miglogd` and `/bin/iked`, mmaps 16KB RWX, injects 1344-byte payload via `/proc/<pid>/mem`
8. Hook matches markers `8550` and `169.254.0.1`, passes 31-byte tags via ring buffer at +0x0F0 and forwarding table at +0x400 across daemons
9. NOP-patch offsets base+0x106F7B8/0x1072E20/0x109A570 and trampoline base+0x135102C
10. Separately write `../../tmp/apache2/conf/md-acme.conf` mapping MDChallengeDns01 to `/bin/node` with rogue ACME server for reverse shell
**How found:** Incident response against a telecom MSP; analysts reconstructed the intrusion from FortiManager artifacts, the `.tm` archive, FortiOS logs showing the `../../../../setup` auto-script, and reverse-engineered the ARM64 lldprx injector and mod_md ACME configs.
**Exploitation:** After FortiJump gave unauthenticated RCE on FortiManager, attackers stole configs and trust material for 500+ FortiGates, brute-forced stored credentials, established SSL-VPN sessions, then used the auto-script traversal to run as root and inject PEERSTITCH into logging and IPsec daemons. A parallel Apache mod_md ACME abuse mapped DNS-01 challenges to /bin/node, injecting shell commands into the domain field to spawn an SSH reverse shell to 23.240.77.233:8084, kept alive by MDRenewMode always.
**Escalation:** Chained FortiJump (FortiManager) -> config/credential theft -> SSL-VPN re-entry -> CVE-2025-61624 root -> memory-resident implant; also impersonated FortiManager over FGFM (CVE-2024-26009 or reused trust material) to pull configs from downstream firewalls as FortiGateCloud account.
**Insight:** Centralized management appliances hold trust material valid for every managed device; after compromise, rotate certs/keys rather than just patching. On FortiOS, audit system.auto-script object names for `../` and check /proc/<pid>/maps of miglogd/iked for anonymous 16KB rwxp regions and 0xAA0003E0 NOP patches.