Changed since version 15

• Added Unit 42's primary report as S1. Campaign facts previously sourced to The Hacker News or an unlisted S6 now cite Unit 42 [S1].
• Renumbered sources: SecurityWeek is S2, the CISA KEV catalog S3, the CISA alert S4, The Hacker News S5, and FortiGuard FG-IR-26-122 S6.
• Verdict now attributes the campaign directly to Unit 42 rather than via The Hacker News [S1].
• Confidence set to high on the strength of the vendor primary source [S1][S6].
• Hunt 2 hit_means adds 47.18.167.159:8085/pM.js as a download source [S1].
• Verify adds leftover component names lldprx, ipssem.js and index.wasm, the mod_md job.json check, and the Unit 42 YARA rule and SHA-256 hashes [S1].
• Verify adds known benign look-alikes.
• Eradicate now lists the mod_md hook, the /data2/template/ components, the rogue registration and the root-cause patches [S1][S6].
• Debrief adds the discrepancy between SecurityWeek's '500+ implanted' summary and Unit 42's '500+ configs exfiltrated' [S1][S2].
• Open questions add the unreadable SecurityWeek source [S2] and the date inconsistency in the thread.

What happened

• CL-STA-0954 (UNC5820) exploited FortiJump (CVE-2024-47575) on a telecom MSP's FortiManager. The actor registered a rogue Virtual FortiGate named localhost (FMG-VMTM23017412) and generated a .tm config archive [S1].
• The actor took configs, credentials and keys for 500+ managed FortiGates. It pushed sniffer configs downstream and used an admin named FortiGateCloud to pull running configs [S1].
• With cracked credentials, the actor opened SSL-VPN sessions from staging infrastructure. It then abused CVE-2025-61624 auto-script path traversal (../../../../setup) to gain root [S1].
• PEERSTITCH is an ARM64 ptrace injector. It patches /bin/miglogd and /bin/iked in memory to bypass validation on tagged VPN sessions. An Apache mod_md ACME hook provided an SSH reverse shell [S1].
• The actor killed miglogd and syslogd, cleared crash logs, and deleted rogue admins, VPN groups and auto-scripts after use [S1].
• CISA added CVE-2025-61624 to KEV on 2026-10-16. Exploitation requires an authenticated admin with read-write permissions [S4].

Timeline

Detect

FortiGate auto-script objects with path traversal names · FortiOS system event / config change logs (syslog or FortiAnalyzer forward)

index=* devid=* type="event" subtype="system" (cfgpath="system.auto-script" OR msg="*auto-script*") (cfgobj="*../*" OR msg="*../*") | stats count min(_time) as first_seen max(_time) as last_seen values(action) as action values(cfgobj) as cfgobj values(msg) as msg by devname user ui

A hit means: An auto-script object with ../ in its name was created, edited or deleted. Unit 42 names ../../../../setup and ../../tmp/apache2/conf/md-acme.conf [S1]. Treat a hit as likely compromise. The actor deletes auto-scripts after use, so a delete event alone matters [S1].

Traffic, web or SSL-VPN sessions involving campaign infrastructure · FortiGate traffic, web filter and VPN event logs; proxy/egress logs

index=* (srcip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR dstip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR remip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR url="*/pM.js" OR (dstport=8085 (url="*/a.js" OR url="*/a.wasm" OR url="*/b.js" OR url="*/dd")) OR (dstport=8084 (url="*/acme/*" OR url="*/directory")) OR url="*/acme/new-acct*" OR url="*/acme/finalize/*" OR url="*/acme/order/*" OR url="*/acme/authz/*") | stats count min(_time) as first_seen max(_time) as last_seen values(dstport) as dstport values(url) as url values(action) as action values(user) as user by devname srcip dstip

A hit means: A device contacted campaign infrastructure. A pM.js fetch from 23.240.77.233:8085 or 47.18.167.159:8085, or a.js, a.wasm, b.js or dd on 8085, matches the component download [S1]. Port 8084 /directory and /acme/ paths on 23.240.77.233 match the mod_md SSH reverse-shell channel [S1]. Inbound SSL-VPN logins from these IPs match stolen-credential use [S1]. ACME paths alone can be benign if the peer is not a campaign IP.

Logging daemons killed, crashlogs cleared, or FortiGateCloud admin activity · FortiOS CLI audit and system event logs

index=* devid=* (msg="*killall*miglogd*" OR msg="*killall*syslogd*" OR msg="*crashlog clear*" OR user="FortiGateCloud") | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as msg values(ui) as ui by devname user

A hit means: Someone stopped logging or cleared crash logs, matching the reported killall -9 miglogd/syslogd and crashlog clear [S1]. An admin named FortiGateCloud pulling running configs matches the actor's activity [S1]. Also check each device's syslog stream for gaps. A successful kill produces silence, not events.

Rogue Virtual FortiGate registration on FortiManager · FortiManager event / device management logs

index=* ("FMG-VMTM23017412" OR ("Virtual FortiGate" AND "localhost") OR ".tm") devid=* | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as msg by devname

A hit means: The rogue Virtual FortiGate serial or name appears, or a .tm archive is referenced [S1]. Treat the FortiManager and every device it manages as in scope. Absence does not clear you, since the actor may use other serials. The bare .tm term is noisy, so confirm by context.

Verify

• Pull config revisions on each FortiGate. Look for auto-script objects containing ../ and for admins or VPN groups that were created then deleted [S1].
• Run diagnose debug crashlog read. Signal 11 crashes in miglogd, iked or syslogd are a reported indicator [S1].
• pM.js deletes itself, so its absence does not clear a device [S5]. Check /data2/template/ for leftover components such as lldprx, ipssem.js and index.wasm [S1].
• Check the Apache mod_md job.json for MDChallengeDns01 mapped to /bin/node, or entries like kali@23.240.77.233:8084 with -F /tmp/upfile/ssh_config [S1].
• With vendor support, inspect /proc/<pid>/maps of /bin/miglogd and /bin/iked for anonymous 16,384-byte rwxp regions [S1].
• Check text at base+0x106F7B8, 0x1072E20 and 0x109A570 for 0xAA0003E0 patches. Audit open/write on /proc/<pid>/mem between miglogd and iked [S1].

Scope

Affected

• FortiOS, FortiPAM, FortiProxy and FortiSwitchManager (CVE-2025-61624) [S4][S6]
• FortiManager (CVE-2024-47575), the initial access in this campaign [S1]
• FortiGates managed by a compromised FortiManager, whose configs and keys were exfiltrated [S1]

Only if

• CVE-2025-61624 requires an authenticated attacker with an admin profile that has read-write permissions [S4].
• In this campaign, that access followed credentials and keys taken via the compromised FortiManager [S1].

Not affected if

None stated by the sources.

Fixed in: See Fortinet FG-IR-26-122 [S6]. Fixed versions are not stated in the provided material.

Enumerate

• Every FortiOS, FortiPAM, FortiProxy, FortiSwitchManager and FortiManager instance, with its running version.
• For each FortiManager: all registered devices, unknown Virtual FortiGates, .tm archives, and the FortiGates it manages.
• All admin accounts, VPN users and groups, including deleted ones visible in config revisions.
• Sniffer configs on FortiGates, especially those capturing TCP 3696-3706, UDP 69, 1812/1813 or TCP 389 [S1].
• Secrets stored in FortiGate configs: admin and VPN credentials, pre-shared keys, certificates, RADIUS/LDAP binds.
• Management and FGFM (TCP 541) exposure per device, and the hosts each FortiGate accepts management connections from.

Contain

• Before patching or rebooting, export config revisions, event logs and crash logs. With vendor support, capture memory of miglogd and iked, where PEERSTITCH runs [S1]. A reboot destroys in-memory artifacts and cannot be undone.
• Block 23.240.77.233, 47.18.167.159, 45.32.41.202 and 198.199.122.22 at egress and for SSL-VPN [S1].
• Block outbound SSH from firewall management addresses unless it is required. The actor used mod_md to spawn SSH reverse shells [S1].
• Restrict management and FGFM access to known FortiManager and admin hosts. Remove internet exposure of FortiManager and admin interfaces.
• Disable unknown admins and VPN accounts. Remove unauthorized sniffer configs and rogue FortiManager device registrations [S1].
• If a FortiManager may be compromised, rotate every credential and key stored in FortiGate configs [S1]. Rotation does not undo exposure of data already taken.
• Apply FG-IR-26-122 and the FortiManager fix for CVE-2024-47575. Where patching lags, confirm FortiGuard virtual patch FG-VD-59270.0day (FMWP db 25.120) is in place [S6].

Eradicate

• Remove auto-script objects with ../ names, rogue admins, VPN groups and sniffer configs [S1].
• Remove the rogue Virtual FortiGate registration and any .tm archives from FortiManager [S1].
• Remove components under /data2/template/ and the mod_md hook (md-acme.conf, job.json mapping MDChallengeDns01 to /bin/node) [S1].
• Close the root causes: patch CVE-2024-47575 on FortiManager and CVE-2025-61624 per FG-IR-26-122 [S1][S6].
• The sources do not say whether PEERSTITCH survives a reboot. Do not treat a reboot alone as eradication.

Recover

• Before restoring, confirm patched firmware, a config matching a known-good baseline, and rotated secrets [S6].
• Confirm syslog flows continuously from each device and crash logs are retained [S1].
• Confirm no 16KB rwxp regions remain in miglogd and iked [S1].
• Afterwards, keep the four hunts running. Alert on new auto-scripts, short-lived admins, sniffer config changes, outbound SSH from firewalls, unexpected FGFM peers and logging gaps [S1].

Re-enter the loop when

• Fortinet updates FG-IR-26-122 with fixed versions, new products or new IoCs [S6].
• Unit 42 or another primary source publishes new infrastructure, hashes or PEERSTITCH variants [S1].
• A primary source states the roles of CVE-2024-26008 or CVE-2024-26009 in the chain.
• Any hunt hits on a FortiManager, which puts every device it manages in scope [S1].
• Evidence shows PEERSTITCH persists across reboot, or the implant reached devices beyond the reported telecom MSP.

Debrief

• Record each device, version, patch date, evidence captured and hunt results.
• Record which secrets were rotated and when, and any logging gaps found.
• Record VPN sessions that could not be validated, given the iked bypass [S1].
• Gap: the provided material does not state fixed versions.
• Gap: the sources do not explain the roles of CVE-2024-26008 and CVE-2024-26009. SecurityWeek-derived summaries call CVE-2024-26008 a FortiJump alias, but the pipeline could not read that source [S2].
• Gap: the sources do not say whether PEERSTITCH survives a reboot.

Detection coverage — checked automatically

Checked automatically 2026-11-01 05:38Z from public sources: 18 published, 27 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2024-47575

vuln:CVE-2024-26008

vuln:CVE-2025-61624

cpe:"cpe:/a:fortinet:fortimanager"

product:"Fortimanager"

host.services: (software.product = "Fortimanager")

cpe:"cpe:/a:fortinet:fortimanager_cloud"

product:"Fortimanager Cloud"

host.services: (software.product = "Fortimanager Cloud")

cpe:"cpe:/a:fortinet:fortiproxy"

product:"Fortiproxy"

host.services: (software.product = "Fortiproxy")

cpe:"cpe:/a:fortinet:fortiswitchmanager"

product:"Fortiswitchmanager"

host.services: (software.product = "Fortiswitchmanager")

http.title:"FortiManager"

http.title:"FortiProxy"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD names 2 more affected products (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Banner spellings: a model read 4 from the NVD names and this card's text (former and marketing names, console titles); 2 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-01 05:38Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• What are the fixed versions for each product under FG-IR-26-122?
• What roles do CVE-2024-26008 and CVE-2024-26009 play? Is CVE-2024-26008 really a FortiJump alias?
• Does PEERSTITCH persist across reboot or firmware upgrade?
• The pipeline could not read the SecurityWeek page [S2], which returned unrelated content. Its claim that the implant was pushed to 500+ FortiGates is uncorroborated.
• Dates are inconsistent. The brief is dated 2026-10-15, but the thread includes stories dated through 2026-10-20 and a KEV listing on 2026-10-16. The analyst should confirm publication dates.
• PAN Threat Prevention signatures for CVE-2024-47575 appear in guidance without a source. They are not included in the card.

Sources

• [S1] https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/ · Unit 42
• [S2] https://www.securityweek.com/exploited-fortinet-bug-linked-to-stealthy-fortigate-implant-in-telecom-hack/ · SecurityWeek
• [S3] https://www.cisa.gov/known-exploited-vulnerabilities-catalog · CISA
• [S4] https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog · CISA
• [S5] https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html · The Hacker News
• [S6] https://fortiguard.fortinet.com/psirt/FG-IR-26-122 · FortiGuard Labs

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.