InfoSecBulletin Cybersecurity for mankind
Cybersecurity researchers at Palo Alto Networks’ Unit 42 have uncovered a sophisticated cyberattack targeting Fortinet network management infrastructure, involving the deployment of a stealthy malware implant known as PEERSTITCH.
According to the investigation, attackers exploited CVE-2024-47575 in FortiManager to steal configuration files, credentials, cryptographic material, and network information associated with more than 500 managed FortiGate firewalls. They later exploited CVE-2025-61624, a FortiOS privilege-escalation vulnerability, to deploy PEERSTITCH.
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
The malware operates directly in memory, injecting malicious code into FortiOS system processes to bypass security checks and maintain covert access. By avoiding persistent files on disk, opening no listening ports, and abusing legitimate system processes for communications, PEERSTITCH makes detection significantly more difficult.
Researchers also observed attackers intercepting network traffic, establishing unauthorized VPN sessions, deploying backdoors, and attempting to conceal their activities by manipulating logs and removing malicious configurations.
Organizations should patch affected Fortinet systems, review FortiManager and FortiGate configurations for unauthorized changes, rotate potentially exposed credentials and cryptographic keys, and investigate suspicious administrative and VPN activity.
For the full report click here.
(Disclaimer: This report summary was prepared with the assistance of AI. While efforts have been made to ensure accuracy, any errors or omissions are unintentional.)
