Changed since version 12

• Source references renumbered to today's set (S1 The Hacker News, S2 FortiGuard, S3 SecurityWeek, S4 CISA KEV, S5 CISA alert). The Unit 42 report is kept as S6.
• Verify: added the 8550 / 169.254.0.1 markers for tagged iked VPN sessions that bypass validation [S1].
• Confidence reason: noted that the SecurityWeek link returned unrelated content and adds no corroboration [S3].
• Open questions: added the 500+ 'pushed' vs 'configs stolen' discrepancy and the unsupported FortiManager-root claim from the 2026-10-20 story [S3][S5].
• Debrief: added a gap for the undocumented log fields behind the session markers [S1].
• Eradicate and reenter_when filled from existing sourced facts.

What happened

• Initial access came from exploiting FortiJump (CVE-2024-47575) on a telecom MSP's FortiManager [S1].
• The actor exfiltrated running configs, cryptographic material and database files covering more than 500 managed FortiGates [S1].
• With that material, the actor set up unauthorized SSL/VPN sessions to perimeter firewalls. It then exploited CVE-2025-61624 to deploy PEERSTITCH [S1].
• An auto-script downloads five components from 23.240.77.233:8085. PEERSTITCH uses ptrace to inject into /bin/miglogd and /bin/iked, and tagged VPN sessions bypass FortiOS validation [S1].
• The actor used Apache mod_md to spawn SSH reverse shells and impersonated FortiManager to pull configs. It also stopped syslog, cleared crash logs, and deleted rogue admins and auto-scripts after use [S1].
• CISA added CVE-2025-61624 to KEV on 2026-10-16. Exploiting it requires an authenticated admin with read-write permissions [S5].

Timeline

Detect

FortiGate auto-script objects with path traversal names · FortiOS system event / config change logs (syslog or FortiAnalyzer forward)

index=* devid=* type="event" subtype="system" (cfgpath="system.auto-script" OR msg="*auto-script*") (cfgobj="*../*" OR msg="*../*") | stats count min(_time) as first_seen max(_time) as last_seen values(action) as action values(cfgobj) as cfgobj values(msg) as msg by devname user ui

A hit means: An auto-script object with ../ in its name was created, edited or deleted. Unit 42 names ../../../../setup and ../../tmp/apache2/conf/md-acme.conf [S6]. Treat a hit as likely compromise. The actor deletes auto-scripts after use, so a delete event alone matters [S1].

Traffic, web or SSL-VPN sessions involving campaign infrastructure · FortiGate traffic, web filter and VPN event logs; proxy/egress logs

index=* (srcip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR dstip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR remip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR url="*/pM.js" OR (dstport=8085 (url="*/a.js" OR url="*/a.wasm" OR url="*/b.js" OR url="*/dd")) OR (dstport=8084 (url="*/acme/*" OR url="*/directory")) OR url="*/acme/new-acct*" OR url="*/acme/finalize/*" OR url="*/acme/order/*" OR url="*/acme/authz/*") | stats count min(_time) as first_seen max(_time) as last_seen values(dstport) as dstport values(url) as url values(action) as action values(user) as user by devname srcip dstip

A hit means: A device contacted campaign infrastructure. Fetches from 23.240.77.233:8085 match the five-component download [S1]. Port 8084 /directory and /acme/ paths match the mod_md SSH reverse-shell channel [S6]. Inbound SSL-VPN logins from these IPs match stolen-credential use [S1][S6]. ACME paths alone can be benign if the peer is not a campaign IP.

Logging daemons killed, crashlogs cleared, or FortiGateCloud admin activity · FortiOS CLI audit and system event logs

index=* devid=* (msg="*killall*miglogd*" OR msg="*killall*syslogd*" OR msg="*crashlog clear*" OR user="FortiGateCloud") | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as msg values(ui) as ui by devname user

A hit means: Someone stopped logging or cleared crash logs, matching the reported anti-logging steps [S1]. An admin named FortiGateCloud pulling running configs over FGFM matches the actor [S6]. Also check each device's syslog stream for gaps. A successful kill produces silence, not events.

Rogue Virtual FortiGate registration on FortiManager · FortiManager event / device management logs

index=* ("FMG-VMTM23017412" OR ("Virtual FortiGate" AND "localhost") OR ".tm") devid=* | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as msg by devname

A hit means: The rogue Virtual FortiGate serial or name appears, or a .tm archive is referenced [S6]. Treat the FortiManager and every device it manages as in scope. Absence does not clear you; the actor may use other serials. The bare .tm term is noisy; confirm by context.

Verify

• Pull config revisions on each FortiGate. Look for auto-script objects containing ../ [S6], and for admins created then deleted [S1].
• pM.js deletes itself, so its absence on disk does not clear a device [S1]. Check /data2/template/ for leftover components [S6].
• In forensic images, look for ipssem.js and lldprx, which drive the ptrace injection into miglogd and iked [S1]. Compare hashes to the SHA256 values Unit 42 publishes [S6].
• Scan images with the Unit 42 YARA rule u42_apt_linux_PEERSTITCH_fortigate_implant [S6].
• In VPN/IKE logs, look for sessions carrying the 8550 or 169.254.0.1 markers tied to tagged sessions that skip validation [S1]. The sources do not give exact log fields.
• Check Apache mod_md job.json for entries like kali@23.240.77.233:8084 with an ssh_config reference [S6].

Scope

Affected

• FortiOS, FortiPAM, FortiProxy and FortiSwitchManager (CVE-2025-61624) [S5][S2]
• FortiManager (CVE-2024-47575), the initial access in this campaign [S1]
• FortiGates managed by a compromised FortiManager, whose configs and keys were exfiltrated [S1]

Only if

• CVE-2025-61624: the attacker is authenticated with an admin profile that has read-write permissions [S5]
• In this campaign, that access followed credentials and keys taken via the compromised FortiManager [S1]

Not affected if

None stated by the sources.

Fixed in: See Fortinet FG-IR-26-122 [S2]. Fixed versions are not stated in the provided material.

Enumerate

• Every FortiOS, FortiPAM, FortiProxy, FortiSwitchManager and FortiManager instance, with its running version.
• For each FortiManager: all registered devices, unknown Virtual FortiGates, .tm archives, and the FortiGates it manages.
• All admin accounts, VPN users and groups, including deleted ones visible in config revisions.
• Secrets stored in FortiGate configs: admin and VPN credentials, pre-shared keys, certificates, RADIUS/LDAP binds.
• Management and FGFM (TCP 541) exposure per device, and which hosts each FortiGate accepts management connections from.
• VPN sessions on each FortiGate since first suspected access, compared against expected users and sources.

Contain

• Before patching or rebooting, export config revisions, event logs and crash logs. With vendor support, capture memory of miglogd and iked; PEERSTITCH injects into those processes [S1]. A reboot destroys in-memory artifacts and cannot be undone.
• Block 23.240.77.233 [S1] and 47.18.167.159, 45.32.41.202 and 198.199.122.22 [S6] at egress and for SSL-VPN.
• Block outbound SSH from firewall management addresses unless required. The actor used mod_md to spawn SSH reverse shells [S1].
• Restrict management and FGFM access to known FortiManager and admin hosts, since the actor impersonated FortiManager [S1]. Remove internet exposure of FortiManager and admin interfaces.
• Disable unknown admins and VPN accounts. Remove unauthorized sniffer configs and rogue FortiManager device registrations [S6].
• If a FortiManager may be compromised, rotate every credential and key stored in FortiGate configs [S1]. Data already taken stays exposed after rotation.
• Apply FG-IR-26-122 [S2] and the FortiManager fix for CVE-2024-47575. Where patching lags, confirm FortiGuard virtual patch FG-VD-59270.0day (FMWP db 25.120) is in place [S2].

Eradicate

• Remove rogue auto-script objects, admin accounts, VPN groups and sniffer configs [S1][S6].
• Remove PEERSTITCH components (pM.js, a.js, a.wasm, b.js, dd, ipssem.js, lldprx) and the miglogd/iked injection, with vendor guidance [S1].
• Remove the malicious mod_md job.json entry and the md-acme.conf change [S6].
• Root cause: patch CVE-2024-47575 on FortiManager and CVE-2025-61624 on affected products [S1][S2]. Rotate all secrets exposed in exfiltrated configs [S1].

Recover

• Before restoring, confirm patched firmware, a config matching a known-good baseline, and rotated secrets [S2].
• Confirm syslog flows continuously from each device and crash logs are retained [S1].
• Afterwards, keep the four hunts running. Alert on new auto-scripts, short-lived admins and sniffer config changes [S1][S6].
• Also alert on outbound SSH from firewalls, unexpected FGFM peers, unexpected VPN sessions and logging gaps [S1].

Re-enter the loop when

• Fortinet updates FG-IR-26-122 with new affected products, fixed versions or exploitation details [S2].
• Unit 42 or another primary source publishes new IPs, hashes or serials for this campaign.
• A hunt hits on a FortiGate not managed by a known-compromised FortiManager.
• Evidence shows PEERSTITCH persists across reboot or firmware upgrade.
• CISA or Fortinet ties CVE-2024-26008 or CVE-2024-26009 to this campaign.

Debrief

• Record each device, version, patch date, evidence captured, and hunt results.
• Record which secrets were rotated and when, and any logging gaps found.
• Record VPN sessions that could not be validated, given the iked bypass [S1].
• Gap: no fixed versions in the provided material.
• Gap: the roles of CVE-2024-26008 and CVE-2024-26009 are not explained. Stories call CVE-2024-26008 an alias of FortiJump, which the sources do not support [S3].
• Gap: whether PEERSTITCH survives a reboot is not stated.

Detection coverage — checked automatically

Checked automatically 2026-11-01 04:31Z from public sources: 18 published, 27 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2024-47575

vuln:CVE-2024-26008

vuln:CVE-2025-61624

cpe:"cpe:/a:fortinet:fortimanager"

product:"Fortimanager"

host.services: (software.product = "Fortimanager")

cpe:"cpe:/a:fortinet:fortimanager_cloud"

product:"Fortimanager Cloud"

host.services: (software.product = "Fortimanager Cloud")

cpe:"cpe:/a:fortinet:fortiproxy"

product:"Fortiproxy"

host.services: (software.product = "Fortiproxy")

cpe:"cpe:/a:fortinet:fortiswitchmanager"

product:"Fortiswitchmanager"

host.services: (software.product = "Fortiswitchmanager")

http.html:"FortiManager"

http.title:"FortiProxy"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD names 2 more affected products (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Banner spellings: a model read 6 from the NVD names and this card's text (former and marketing names, console titles); 2 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-01 04:31Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• The Unit 42 report (S6) is carried from the prior draft and is not in today's source set. The reviewer should confirm its IPs, serials, YARA rule and file paths still match it.
• The 2026-10-20 story says the implant was pushed to 500+ FortiGates. S1 says configs for 500+ were stolen. The card keeps the S1 wording.
• The 2026-10-20 story suggests CVE-2025-61624 was used against FortiManager for root access. S5 lists only FortiOS, FortiPAM, FortiProxy and FortiSwitchManager as affected.
• Is CVE-2024-26008 related to FortiJump? NVD and KEV data do not support the alias.
• Story dates run from 10-16 to 10-20, while the brief date is 10-16 and the 10-16 story is marked as today. Check the ordering.

Sources

• [S1] https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html · The Hacker News
• [S2] https://fortiguard.fortinet.com/psirt/FG-IR-26-122 · FortiGuard Labs
• [S3] https://www.securityweek.com/exploited-fortinet-bug-linked-to-stealthy-fortigate-implant-in-telecom-hack/ · SecurityWeek
• [S4] https://www.cisa.gov/known-exploited-vulnerabilities-catalog · CISA
• [S5] https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog · CISA

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.