Changed since version 2

• Sources renumbered to match this run: S1 The Hacker News, S2 FG-IR-26-122, S3 SecurityWeek, S4 CISA KEV catalog, S5 CISA alert. The Unit 42 report is kept as S6.
• Added the Apache mod_md SSH reverse shell, the iked validation bypass for tagged VPN sessions, and FortiManager impersonation config pulls to What happened, Verify, Contain and Recover [S1].
• Added component filenames index.js, index.wasm, ipssem.js and lldprx [S1].
• Added a contain step to check the interim virtual patch listed in FG-IR-26-122 [S2].
• Added the KEV federal due date of 2026-10-19 to the timeline [S4].
• Added a contain step to block outbound SSH from firewalls, and FGFM peer enumeration to Scope [S1].
• Flagged the SecurityWeek link and the CVE-2024-26008 conflation as open questions [S3].

What happened

• CL-STA-0954 (aka UNC5820) got initial access to a telecom MSP's FortiManager through FortiJump, CVE-2024-47575 [S1][S6].
• The actor exfiltrated running configs, cryptographic material and database files covering more than 500 managed FortiGates [S1].
• It used the stolen material for unauthorized SSL/VPN sessions to perimeter firewalls [S1].
• It then exploited CVE-2025-61624 to deploy PEERSTITCH. CVE-2025-61624 is a FortiOS CLI path traversal that lets a read-write admin write or delete arbitrary files [S1][S5].
• PEERSTITCH is an ARM64 injector fetched by an auto-script from 23.240.77[.]233:8085. It ptrace-injects into /bin/miglogd and /bin/iked, and the iked hook bypasses FortiOS validation for tagged VPN sessions [S1].
• The actor also used Apache mod_md to spawn SSH reverse shells, impersonated FortiManager to pull configs from other firewalls, and disrupted logging [S1].

Timeline

Detect

FortiGate auto-script objects with path traversal names · FortiOS system event / config change logs (syslog or FortiAnalyzer forward)

index=* devid=* type="event" subtype="system" (cfgpath="system.auto-script" OR msg="*auto-script*") (cfgobj="*../*" OR msg="*../*") | stats count min(_time) as first_seen max(_time) as last_seen values(action) as action values(cfgobj) as cfgobj values(msg) as msg by devname user ui

A hit means: An auto-script object was created, edited or deleted with ../ in its name. This is the delivery method for PEERSTITCH components [S1][S6]. Treat it as likely compromise. The actor deletes auto-scripts after execution, so a delete event alone matters [S1].

Traffic or SSL-VPN sessions involving campaign IPs · FortiGate traffic and VPN event logs, proxy/egress logs

index=* (srcip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR dstip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR remip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22")) | stats count min(_time) as first_seen max(_time) as last_seen values(dstport) as dstport values(action) as action values(user) as user by devname srcip dstip

A hit means: A device talked to campaign infrastructure. Outbound to 23.240.77.233 on 8085 matches the component download [S1]. Port 8084 and the ACME channel are per [S6]. Inbound SSL-VPN logins match the actor's use of stolen credentials [S1]. Confirm the role of the other IPs against [S6].

Logging daemons killed, crashlogs cleared, or FortiGateCloud admin activity · FortiOS CLI audit and system event logs

index=* devid=* (msg="*killall*miglogd*" OR msg="*killall*syslogd*" OR msg="*crashlog clear*" OR user="FortiGateCloud") | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as msg values(ui) as ui by devname user

A hit means: Someone stopped logging, cleared crashlogs, or an admin named FortiGateCloud acted on the device. Syslog termination and crash-log clearing are reported tradecraft [S1]. The specific commands and account name are per [S6]. Also check each device's syslog stream for gaps; a successful kill produces silence, not events.

Rogue Virtual FortiGate registration on FortiManager · FortiManager event / device management logs

index=* "FMG-VMTM23017412" | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as msg by host

A hit means: The serial of the rogue Virtual FortiGate Unit 42 observed appears in your logs [S6]. Treat the FortiManager and every device it manages as in scope. Absence does not clear you; the actor may use other serials.

Verify

• Pull config revisions on each FortiGate. Look for system.auto-script objects containing ../, and for unexpected sniffer configs, admins or VPN groups. Include short-lived admins that were created then deleted [S1][S6].
• Run 'diagnose debug crashlog read' and look for Signal 11 crashes in miglogd, iked or syslogd [S6].
• With vendor support, inspect miglogd and iked memory for injected executable regions [S1]. Scan with the Unit 42 YARA rule u42_apt_linux_PEERSTITCH_fortigate_implant [S6].
• Look for component files pM.js, a.js, index.js, a.wasm, index.wasm, b.js, ipssem.js, dd and lldprx [S1]. Check the paths /data2/template/ and /tmp/apache2/conf/md-acme.conf [S6].
• Look for SSH sessions spawned from Apache mod_md on the FortiGate [S1].
• Look for VPN/IKE traffic carrying the 8550 / 169.254.0.1 markers, and for config pulls from a host posing as FortiManager [S1].

Scope

Affected

• FortiOS, FortiPAM, FortiProxy, FortiSwitchManager (CVE-2025-61624) [S4][S5]
• FortiManager (CVE-2024-47575), the initial access in this campaign [S1]
• FortiGates managed by a compromised FortiManager, whose configs and keys were exfiltrated [S1]

Only if

• CVE-2025-61624: the attacker is authenticated with an admin profile that has read-write permissions [S5]
• In this campaign, access came from configs and credentials stolen via the FortiManager [S1]

Not affected if

None stated by the sources.

Fixed in: See Fortinet FG-IR-26-122 [S2]. Fixed versions are not stated in the provided material.

Enumerate

• Every FortiOS, FortiPAM, FortiProxy, FortiSwitchManager and FortiManager instance, with its running version.
• For each FortiManager: all registered devices, any unknown Virtual FortiGates, and which FortiGates it manages.
• All admin accounts, VPN users and groups, including deleted ones visible in config revisions.
• Secrets stored in FortiGate configs: admin and VPN credentials, pre-shared keys, certificates, RADIUS/LDAP binds.
• Management and FGFM (TCP 541) exposure for each device, and which hosts each FortiGate accepts management connections from.
• Log retention per device, and gaps in syslog delivery.

Contain

• Before patching or rebooting, export config revisions, event logs and crashlogs. With vendor support, also capture memory of miglogd and iked. PEERSTITCH is memory-resident; a reboot destroys those artifacts and cannot be undone [S1].
• Block 23.240.77.233 and the other campaign IPs at egress and for SSL-VPN [S1][S6].
• Block outbound SSH from firewall management addresses unless required [S1].
• Restrict management and FGFM access to known FortiManager and admin hosts, since the actor impersonated FortiManager [S1]. Remove internet exposure of FortiManager and admin interfaces.
• Disable unknown admins and VPN accounts. Remove unauthorized sniffer configs and rogue FortiManager device registrations [S6].
• If a FortiManager may be compromised, rotate every credential and key stored in FortiGate configs; the actor exfiltrated them [S1]. Old credentials stay exposed even after rotation.
• Apply FG-IR-26-122 [S2] and the FortiManager fix for CVE-2024-47575. Where patching lags, check whether the interim virtual patch listed in FG-IR-26-122 is in place [S2].

Eradicate

• Remove rogue admins, auto-script objects, sniffer configs and rogue device registrations [S1][S6].
• Remove PEERSTITCH components and processes (ipssem.js, lldprx and the downloaded files) [S1]. Rely on vendor guidance for clean firmware rather than manual deletion.
• Treat a FortiManager compromised via CVE-2024-47575 as untrusted until rebuilt and patched [S1].
• Replace all secrets taken from device configs [S1].

Recover

• Before restoring, confirm patched firmware, a config matching a known-good baseline, and rotated secrets [S2].
• Confirm syslog flows continuously from each device to the collector.
• Afterwards, keep the four hunts running. Alert on new auto-scripts, short-lived admins, outbound SSH from firewalls, unexpected FGFM peers and logging gaps [S1].

Re-enter the loop when

• Fortinet updates FG-IR-26-122 with fixed versions, new affected products or new indicators [S2].
• CISA adds CVE-2024-26008 or CVE-2024-26009 to KEV, or links them to this campaign [S4].
• Any hit on a FortiGate managed by a FortiManager, or evidence of config pulls by a host posing as FortiManager [S1].
• New PEERSTITCH IoCs or infrastructure beyond 23.240.77.233 are published [S1].
• Evidence that PEERSTITCH survives a reboot or firmware upgrade.

Debrief

• Record each device, version, patch date, evidence captured, and hunt results.
• Record which secrets were rotated and when, and any logging gaps found.
• Gap: no fixed versions in the provided material.
• Gap: the roles of CVE-2024-26008 and CVE-2024-26009 are not explained.
• Gap: whether PEERSTITCH survives a reboot is not stated.
• Gap: the meaning of the 8550 / 169.254.0.1 VPN markers is not explained.

Detection coverage — checked automatically

Checked automatically 2026-10-31 22:47Z from public sources: 18 published, 27 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2024-47575

vuln:CVE-2024-26008

vuln:CVE-2025-61624

cpe:"cpe:/a:fortinet:fortimanager"

product:"Fortimanager"

host.services: (software.product = "Fortimanager")

cpe:"cpe:/a:fortinet:fortimanager_cloud"

product:"Fortimanager Cloud"

host.services: (software.product = "Fortimanager Cloud")

cpe:"cpe:/a:fortinet:fortiproxy"

product:"Fortiproxy"

host.services: (software.product = "Fortiproxy")

cpe:"cpe:/a:fortinet:fortiswitchmanager"

product:"Fortiswitchmanager"

host.services: (software.product = "Fortiswitchmanager")

http.title:"FortiManager"

http.title:"FortiProxy"

NVD names 2 more affected products (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Banner spellings: a model read 4 from the NVD names and this card's text (former and marketing names, console titles); 2 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-31 22:47Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• The SecurityWeek link [S3] reportedly returned unrelated page content; its claims are uncorroborated.
• The 2026-10-20 story says CVE-2024-47575 is 'also cited as CVE-2024-26008'. That conflicts with treating them as separate CVEs; the relationship needs a primary source.
• The Unit 42 report [S6] was not among this run's provided sources. Details sourced only to it (extra IPs, rogue serial, YARA rule, file paths, killall commands, the FortiGateCloud account) should be re-checked against it.
• What are the 8550 / 169.254.0.1 markers in practice, and how can they be logged?
• What role does CVE-2024-26009 play?

Sources

• [S1] https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html · The Hacker News
• [S2] https://fortiguard.fortinet.com/psirt/FG-IR-26-122 · FortiGuard Labs
• [S3] https://www.securityweek.com/exploited-fortinet-bug-linked-to-stealthy-fortigate-implant-in-telecom-hack/ · SecurityWeek
• [S4] https://www.cisa.gov/known-exploited-vulnerabilities-catalog · CISA
• [S5] https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog · CISA

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.