Changed since version 1

• Title, verdict and confidence: the PeerStitch / FortiManager link is now reported by Unit 42 primary research, no longer unconfirmed [S1].
• Sources renumbered: S1 Unit 42, S2 SecurityWeek, S3 KEV catalog, S4 CISA alert, S5 The Hacker News, S6 FG-IR-26-122.
• Removed BOD 26-04 references; that source is not in the current set.
• Scope: added FortiManager and its managed FortiGates; added enumeration of stored secrets and FGFM exposure [S1].
• Detect: replaced generic CLI and rare-login hunts with auto-script traversal, campaign IP, log-kill/FortiGateCloud and rogue registration hunts [S1].
• Verify, contain, eradicate and recover: added Unit 42 artifacts, memory-evidence warning and credential rotation [S1].
• Added timeline, Fortinet advisory source and fixed_in reference [S6].

What happened

• CISA added CVE-2025-61624, a path traversal in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, to KEV on 2026-10-16 based on evidence of active exploitation [S4].
• Exploitation requires an authenticated attacker with a read-write admin profile, who can write or delete arbitrary files via specific CLI commands [S4].
• Unit 42 reports CL-STA-0954 (UNC5820) exploited FortiJump (CVE-2024-47575) on a telecom MSP's FortiManager, registered a rogue Virtual FortiGate 'localhost' (serial FMG-VMTM23017412), and exfiltrated a .tm configuration archive [S1].
• The actor pushed sniffer configs to managed FortiGates, opened SSL-VPN sessions with cracked credentials, and used auto-script objects named ../../../../setup to drop the PEERSTITCH loader from 23.240.77[.]233:8085 [S1].
• PEERSTITCH ptrace-injects into /bin/miglogd and /bin/iked to patch them in memory; Unit 42 also describes an Apache mod_md ACME config that spawned an SSH reverse shell [S1].
• The actor killed miglogd and syslogd, cleared crashlogs, and deleted rogue admins, VPN groups and auto-script objects after use [S1].

Timeline

Detect

FortiGate auto-script objects with path traversal names · FortiOS system event / config change logs (syslog or FortiAnalyzer forward)

index=* devid=* type="event" subtype="system" (cfgpath="system.auto-script" OR msg="*auto-script*") (cfgobj="*../*" OR msg="*../*") | stats count min(_time) as first_seen max(_time) as last_seen values(action) as action values(cfgobj) as cfgobj values(msg) as msg by devname user ui

A hit means: An auto-script object was created, edited or deleted with ../ in its name, the technique Unit 42 ties to the PEERSTITCH loader and md-acme.conf drop [S1]. Treat as likely compromise; the actor deleted these objects shortly after use, so a delete event alone matters [S1].

Traffic or SSL-VPN sessions involving campaign IPs · FortiGate traffic and VPN event logs, proxy/egress logs

index=* (srcip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR dstip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR remip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22")) | stats count min(_time) as first_seen max(_time) as last_seen values(dstport) as dstport values(action) as action values(user) as user by devname srcip dstip

A hit means: A device talked to campaign infrastructure. Outbound to 23.240.77.233 on 8085 or 8084 matches the loader download and ACME reverse-shell channel [S1]; inbound SSL-VPN logins match the actor's use of cracked credentials [S1]. Confirm the role of the other IPs against [S1].

Logging daemons killed, crashlogs cleared, or FortiGateCloud admin activity · FortiOS CLI audit and system event logs

index=* devid=* (msg="*killall*miglogd*" OR msg="*killall*syslogd*" OR msg="*crashlog clear*" OR user="FortiGateCloud") | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as msg values(ui) as ui by devname user

A hit means: Someone stopped local or remote logging, cleared crashlogs, or an admin named FortiGateCloud acted on the device. Unit 42 lists all three as actor tradecraft [S1]. Also check for gaps in each device's syslog stream, since a successful kill produces silence rather than events.

Rogue Virtual FortiGate registration on FortiManager · FortiManager event / device management logs

index=* "FMG-VMTM23017412" | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as msg by host

A hit means: The serial of the rogue Virtual FortiGate Unit 42 observed appears in your logs [S1]. Treat the FortiManager and every device it manages as in scope. Absence does not clear you; the actor may use other serials.

Verify

• Pull config revisions on each FortiGate and look for system.auto-script objects containing ../ and for unexpected sniffer configs, admins or VPN groups [S1].
• Run 'diagnose debug crashlog read' and look for Signal 11 crashes in miglogd, iked or syslogd [S1].
• With vendor support, inspect /proc/<pid>/maps of miglogd and iked for anonymous 16,384-byte rwxp regions, and scan with the Unit 42 YARA rule u42_apt_linux_PEERSTITCH_fortigate_implant [S1].
• Check /data2/template/ for pM.js, a.js, a.wasm, b.js and dd, and /tmp/apache2/conf/md-acme.conf for '#0 certs managed by ACME' [S1].
• Benign look-alikes: legitimate auto-scripts (but not with ../ names), admin-run crashlog clears during troubleshooting, syslog gaps from reboots or upgrades, legitimate FortiManager config pushes, and any genuine Fortinet cloud-management account; confirm each against change records.
• Inbound scans from the IoC IPs without a completed session are weaker than outbound fetches or successful VPN logins.

Scope

Affected

• FortiOS, FortiPAM, FortiProxy, FortiSwitchManager (CVE-2025-61624) [S3][S4]
• FortiManager (CVE-2024-47575), the initial access in the Unit 42 campaign [S1]
• FortiGates managed by a compromised FortiManager, whose configs and keys were exfiltrated [S1]

Only if

• CVE-2025-61624: the attacker is authenticated with a read-write admin profile [S4]
• In the Unit 42 case, those credentials came from configs stolen via the FortiManager [S1]

Not affected if

None stated by the sources.

Fixed in: See Fortinet FG-IR-26-122 [S6]. Fixed versions are not stated in the provided material.

Enumerate

• Every FortiOS, FortiPAM, FortiProxy, FortiSwitchManager and FortiManager instance, with running version.
• For each FortiManager: all registered devices, any unknown Virtual FortiGates, and which FortiGates it manages.
• All admin accounts, VPN users and groups, including deleted ones visible in config revisions.
• Secrets stored in FortiGate configs: admin and VPN credentials, pre-shared keys, certificates, RADIUS/LDAP binds.
• Management and FGFM (TCP 541) exposure for each device.
• Log retention per device, and gaps in syslog delivery.

Contain

• Before patching or rebooting, export config revisions, event logs, crashlogs and, with vendor support, memory of miglogd and iked. PEERSTITCH is memory-resident; a reboot destroys those artifacts and cannot be undone [S1].
• Block 23.240.77.233 and the other campaign IPs at egress and for SSL-VPN [S1].
• Restrict management and FGFM access to trusted hosts; remove internet exposure of FortiManager and admin interfaces.
• Disable unknown admins and VPN accounts, and remove unauthorized sniffer configs and rogue FortiManager device registrations [S1].
• Rotate every credential and key stored in FortiGate configs if a FortiManager may be compromised; the actor exfiltrated and cracked them [S1]. Old credentials remain exposed even after rotation.
• Apply FG-IR-26-122 [S6] and the FortiManager fix for CVE-2024-47575.

Eradicate

• Remove auto-script objects with ../ names and the files they dropped in /data2/template/ [S1].
• Remove /tmp/apache2/conf/md-acme.conf and any mod_md job.json mapping MDChallengeDns01 to /bin/node [S1].
• Clear injected miglogd and iked by restoring clean firmware after evidence capture; whether PEERSTITCH persists across reboot is not stated.
• Remove the rogue Virtual FortiGate registration and any .tm archive on the FortiManager [S1].
• Close the root cause: patched firmware, rotated secrets, and no unauthorized read-write admins.

Recover

• Before restoring, confirm patched firmware, a config matching a known-good baseline, and rotated secrets [S6].
• Confirm syslog flows continuously from each device to the collector.
• Afterwards, keep the four hunts running, and alert on new auto-scripts, FortiGateCloud admin downloads, sniffer config pushes and logging gaps [S1].

Re-enter the loop when

• Fortinet updates FG-IR-26-122 with fixed versions, IoCs or new affected products [S6].
• Unit 42 or another primary source publishes new IoCs or ties CVE-2024-26008 or CVE-2024-26009 to the chain [S1].
• Any hit on a FortiManager: every device it manages enters scope [S1].
• A syslog gap or crashlog clear appears on any Fortinet device.
• CISA adds a further Fortinet CVE linked to this actor.

Debrief

• Record each device, version, patch date, evidence captured, and hunt results.
• Record which secrets were rotated and when, and any logging gaps found.
• Gap: no fixed versions in the provided material.
• Gap: the roles of CVE-2024-26008 and CVE-2024-26009 are not explained.
• Gap: whether PEERSTITCH survives a reboot is not stated.

Detection coverage — checked automatically

Checked automatically 2026-10-31 21:13Z from public sources: 18 published, 27 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2024-47575

vuln:CVE-2024-26008

vuln:CVE-2025-61624

cpe:"cpe:/a:fortinet:fortimanager"

product:"Fortimanager"

host.services: (software.product = "Fortimanager")

cpe:"cpe:/a:fortinet:fortimanager_cloud"

product:"Fortimanager Cloud"

host.services: (software.product = "Fortimanager Cloud")

cpe:"cpe:/a:fortinet:fortiproxy"

product:"Fortiproxy"

host.services: (software.product = "Fortiproxy")

cpe:"cpe:/a:fortinet:fortiswitchmanager"

product:"Fortiswitchmanager"

host.services: (software.product = "Fortiswitchmanager")

http.title:"FortiManager"

http.title:"FortiProxy"

NVD names 2 more affected products (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Banner spellings: a model read 4 from the NVD names and this card's text (former and marketing names, console titles); 2 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-31 21:13Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Date inconsistency: brief date is 2026-10-15, but stories are dated 2026-10-16 to 2026-10-20 and KEV listing is 2026-10-16; the 'today' story is the oldest.
• SecurityWeek [S2] returned unrelated page content; its claims are not used.
• The roles of IPs 45.32.41.202, 47.18.167.159 and 198.199.122.22, and the hashes, should be checked against [S1]; the IoC list carries no per-item source.
• The story lists CVE-2024-26008 as 'also cited as' FortiJump; prior coverage data describes it as an FGFM connection-reset flaw. Its role is unclear.
• Prior BOD 26-04 forensic-triage guidance is no longer in the source set; confirm before citing.
• The PAN signature IDs in published guidance carry no source reference and are not used.

Sources

• [S1] https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/ · Unit 42 (Palo Alto Networks)
• [S2] https://www.securityweek.com/exploited-fortinet-bug-linked-to-stealthy-fortigate-implant-in-telecom-hack/ · SecurityWeek
• [S3] https://www.cisa.gov/known-exploited-vulnerabilities-catalog · CISA
• [S4] https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog · CISA
• [S5] https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html · The Hacker News
• [S6] https://fortiguard.fortinet.com/psirt/FG-IR-26-122 · Fortinet PSIRT

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.