/
← Voltar ao feed
high telecommunications managed service providers

CL-STA-0954 exploits FortiOS CVE-2025-61624 to deploy memory-resident ARM64 implant PEERSTITCH after FortiJump breach

1 fonte(s) · 1 atualização(ões) · publicado 16/10/2026 01:59 · coletado há 2 dias

Palo Alto Networks Unit 42 reports that a suspected advanced actor tracked as CL-STA-0954 (aka UNC5820) deployed a previously unreported memory-resident ARM64 implant, PEERSTITCH, on Fortinet FortiGate firewalls. The group exploited the FortiOS path traversal flaw CVE-2025-61624 for the final stage. The intrusion hit a telecommunications managed service provider in September 2024, with initial access gained through the FortiManager flaw FortiJump (CVE-2024-47575). The attackers exfiltrated configurations, credentials and private keys for more than 500 managed FortiGate firewalls. On October 16, 2026, CISA added CVE-2025-61624 to its KEV catalog, with a federal remediation deadline of October 19, 2026.

Detalhes técnicos

  • CVE-2025-61624 (CVSS 5.4) is a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. A privileged attacker can use crafted arguments to write or delete arbitrary files. Fortinet patched it in April 2026.
  • After compromising FortiManager, the actors stole an archive containing running configurations, SQLite management databases, a serial number and public IP inventory of 500+ FortiGates, network topology and routing data, ciphertext admin/local/SSL-VPN credentials, and certificates and private keys.
  • They used the stolen data for reconnaissance, long-term access, traffic interception, rogue FortiGate SSL/VPN sessions to perimeter firewalls and backdoor deployment. They also impersonated FortiManager to pull from managed firewalls.
  • PEERSTITCH is a 64-bit Linux ARM64 C executable. An auto-script downloads five components from 23.240.77[.]233:8085: pM.js (self-deleting prep script), a.js (saved as index.js), a.wasm (saved as index.wasm), b.js (saved as ipssem.js, the orchestrator) and dd (saved as lldprx, the native ELF injector).
  • After an execution delay, lldprx uses ptrace (PTRACE_INTERRUPT) to inject code into /bin/miglogd and /bin/iked. This builds a covert in-memory communication bridge between the two daemons, with no persistent binary on disk, no listening ports and no outbound connections.
  • The miglogd hook looks for markers in traffic data (TCP port 8550 and IP 169.254.0.1) and passes the session token to iked. The iked hook then takes an alternative execution path for tagged VPN sessions, bypassing default FortiOS security validations.
  • A separate C2 channel abused the native Apache mod_md module on FortiGate to spawn an SSH-based reverse shell.
  • Anti-forensics included terminating syslog generation, clearing crash logs, disrupting logging telemetry, and automatically deleting rogue admin accounts and auto-script objects.
  • Unit 42 suspects, without confirmation, that CVE-2024-26009 and CVE-2024-26008 were used for the FortiManager impersonation. Both require FortiGate Cloud/FortiCloud SSO enrollment, which none of the affected firewalls had.

Remediação

  • Apply Fortinet's April 2026 patches for CVE-2025-61624. CISA requires federal agencies to do so by October 19, 2026.
  • Patch FortiManager against CVE-2024-47575.
  • Given the exposure of credentials, certificates and private keys, rotate them on managed FortiGate devices and review the integrity of FortiGate/FortiManager appliances.
  • Hunt for the listed network indicator and file names, and review the use of mod_md and auto-script objects on FortiGate devices.

Linha do tempo

  1. thehackernews.com ↗ · pub. 16/10/2026 01:59 · coletado 19/10 17:53 primeiro registro

    CL-STA-0954 exploits FortiOS CVE-2025-61624 to deploy memory-resident ARM64 implant PEERSTITCH after FortiJump breach

    ler a análise desta fonte

    Palo Alto Networks Unit 42 reports that a suspected advanced actor tracked as CL-STA-0954 (aka UNC5820) deployed a previously unreported memory-resident ARM64 implant, PEERSTITCH, on Fortinet FortiGate firewalls. The group exploited the FortiOS path traversal flaw CVE-2025-61624 for the final stage. The intrusion hit a telecommunications managed service provider in September 2024, with initial access gained through the FortiManager flaw FortiJump (CVE-2024-47575). The attackers exfiltrated configurations, credentials and private keys for more than 500 managed FortiGate firewalls. On October 16, 2026, CISA added CVE-2025-61624 to its KEV catalog, with a federal remediation deadline of October 19, 2026.

    Technical Details

    • CVE-2025-61624 (CVSS 5.4) is a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. A privileged attacker can use crafted arguments to write or delete arbitrary files. Fortinet patched it in April 2026.
    • After compromising FortiManager, the actors stole an archive containing running configurations, SQLite management databases, a serial number and public IP inventory of 500+ FortiGates, network topology and routing data, ciphertext admin/local/SSL-VPN credentials, and certificates and private keys.
    • They used the stolen data for reconnaissance, long-term access, traffic interception, rogue FortiGate SSL/VPN sessions to perimeter firewalls and backdoor deployment. They also impersonated FortiManager to pull from managed firewalls.
    • PEERSTITCH is a 64-bit Linux ARM64 C executable. An auto-script downloads five components from 23.240.77[.]233:8085: pM.js (self-deleting prep script), a.js (saved as index.js), a.wasm (saved as index.wasm), b.js (saved as ipssem.js, the orchestrator) and dd (saved as lldprx, the native ELF injector).
    • After an execution delay, lldprx uses ptrace (PTRACE_INTERRUPT) to inject code into /bin/miglogd and /bin/iked. This builds a covert in-memory communication bridge between the two daemons, with no persistent binary on disk, no listening ports and no outbound connections.
    • The miglogd hook looks for markers in traffic data (TCP port 8550 and IP 169.254.0.1) and passes the session token to iked. The iked hook then takes an alternative execution path for tagged VPN sessions, bypassing default FortiOS security validations.
    • A separate C2 channel abused the native Apache mod_md module on FortiGate to spawn an SSH-based reverse shell.
    • Anti-forensics included terminating syslog generation, clearing crash logs, disrupting logging telemetry, and automatically deleting rogue admin accounts and auto-script objects.
    • Unit 42 suspects, without confirmation, that CVE-2024-26009 and CVE-2024-26008 were used for the FortiManager impersonation. Both require FortiGate Cloud/FortiCloud SSO enrollment, which none of the affected firewalls had.

    Remediation

    • Apply Fortinet's April 2026 patches for CVE-2025-61624. CISA requires federal agencies to do so by October 19, 2026.
    • Patch FortiManager against CVE-2024-47575.
    • Given the exposure of credentials, certificates and private keys, rotate them on managed FortiGate devices and review the integrity of FortiGate/FortiManager appliances.
    • Hunt for the listed network indicator and file names, and review the use of mod_md and auto-script objects on FortiGate devices.