Security1 hOctober 15, 2026, 22:24

Unit 42 uncovers PEERSTITCH implant: configs of 500+ FortiGate devices stolen

Unit 42 detailed an intrusion by CL-STA-0954 that exploited CVE-2024-47575 in FortiManager to steal configurations, keys and credentials for over 500 FortiGate devices, then used CVE-2025-61624 to gain root and inject the memory-resident PEERSTITCH implant into miglogd and iked.

DEV Community

Open source

Unit 42 uncovers PEERSTITCH implant: configs of 500+ FortiGate devices stolen

CVE-2024-47575 in FortiManager exposed configs and keys of 500+ FortiGate devices
CVE-2025-61624 enabled root and PEERSTITCH injection into miglogd and iked
The implant is memory-only and makes no outbound connections
Fixes: FortiManager 7.6.1+, FortiOS 7.4.10 or 7.6.5+

#Fortinet#FortiGate#FortiManager#Unit42

Dutch Intelligence: Chinese Malware Coathanger Survives Firmware Patches, Hit 20,000 Edge Devices

Security

FortiBleed Attackers Lock Victims Out of Fortinet Devices

Security

983,992 FortiGate Instances Found as CVE-2025-25249 Hits CISA KEV

Security

Unit 42 uncovers PEERSTITCH implant: configs of 500+ FortiGate devices stolen

Dutch Intelligence: Chinese Malware Coathanger Survives Firmware Patches, Hit 20,000 Edge Devices

FortiBleed Attackers Lock Victims Out of Fortinet Devices

983,992 FortiGate Instances Found as CVE-2025-25249 Hits CISA KEV

ACSC warns of widespread credential-based attacks on FortiGate gateways