Changed since version 3

• Added the Unit 42 primary report as S1. Renumbered references: SecurityWeek now S2, KEV catalog S3, CISA alert S4, The Hacker News S5, FG-IR-26-122 S6.
• Confidence set to high: core claims now trace to the Unit 42 primary source [S1].
• what_happened: added the rogue Virtual FortiGate, the .tm archive, sniffer config pushes, the FortiGateCloud config downloads and the mod_md reverse shell [S1].
• Detect: the infrastructure hunt adds 47.18.167.159:8085/pM.js and the 8084 /acme/ URL paths. The FortiManager hunt adds the 'localhost' name and .tm [S1].
• Verify: added /proc maps RWX 16KB and patch-offset checks, sniffer port list, mod_md job.json, the md-acme.conf content string, the SHA-256 hashes and benign look-alikes [S1].
• Contain: named all four campaign IPs [S1].
• Added eradicate and re-entry triggers [S1][S6].
• Debrief: removed the 8550 / 169.254.0.1 gap; tagged VPN sessions are described [S5] and 169.254.0.1 is a YARA string [S1]. Added the hash-mapping and SecurityWeek gaps.

What happened

• The actor exploited FortiJump (CVE-2024-47575) on a telecom MSP's FortiManager. It registered a rogue Virtual FortiGate named localhost (serial FMG-VMTM23017412) and created a .tm configuration archive [S1].
• It took configs, credentials and keys for 500+ managed FortiGates. It pushed unauthorized sniffer configs to downstream firewalls, and an admin named FortiGateCloud downloaded running configs [S1].
• Using stolen credentials, it opened SSL-VPN sessions from staging infrastructure. It then abused the CVE-2025-61624 auto-script path traversal (../../../../setup) to drop a loader [S1][S5].
• The loader fetched components from 23.240.77.233:8085 into /data2/template/. PEERSTITCH ptrace-injects into /bin/miglogd and /bin/iked to bypass validation on tagged VPN sessions [S1][S5].
• An Apache mod_md ACME hook ran /bin/node and opened an SSH reverse shell to 23.240.77.233:8084. The actor killed syslog daemons, cleared crashlogs, and deleted its admins, VPN groups and auto-scripts [S1].
• CISA added CVE-2025-61624 (FortiOS, FortiPAM, FortiProxy, FortiSwitchManager) to KEV on 2026-10-16 on evidence of active exploitation [S3][S4].

Timeline

Detect

FortiGate auto-script objects with path traversal names · FortiOS system event / config change logs (syslog or FortiAnalyzer forward)

index=* devid=* type="event" subtype="system" (cfgpath="system.auto-script" OR msg="*auto-script*") (cfgobj="*../*" OR msg="*../*") | stats count min(_time) as first_seen max(_time) as last_seen values(action) as action values(cfgobj) as cfgobj values(msg) as msg by devname user ui

A hit means: An auto-script object was created, edited or deleted with ../ in its name, such as ../../../../setup or ../../tmp/apache2/conf/md-acme.conf. This is how PEERSTITCH was delivered [S1]. Treat it as likely compromise. The actor deletes auto-scripts after execution, so a delete event alone matters [S1].

Traffic, web or SSL-VPN sessions involving campaign infrastructure · FortiGate traffic, web filter and VPN event logs; proxy/egress logs

index=* (srcip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR dstip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR remip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR url="*/pM.js" OR url="*/acme/new-acct*" OR url="*/acme/finalize/*") | stats count min(_time) as first_seen max(_time) as last_seen values(dstport) as dstport values(url) as url values(action) as action values(user) as user by devname srcip dstip

A hit means: A device talked to campaign infrastructure. Outbound traffic to 23.240.77.233 or 47.18.167.159 on port 8085 for pM.js matches the component download. Port 8084 /acme/ paths match the mod_md reverse-shell channel. Inbound SSL-VPN logins match use of stolen credentials [S1]. ACME paths alone can be benign if the URL is not on a campaign IP.

Logging daemons killed, crashlogs cleared, or FortiGateCloud admin activity · FortiOS CLI audit and system event logs

index=* devid=* (msg="*killall*miglogd*" OR msg="*killall*syslogd*" OR msg="*crashlog clear*" OR user="FortiGateCloud") | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as msg values(ui) as ui by devname user

A hit means: Someone stopped logging or cleared crashlogs, or an admin named FortiGateCloud acted on the device. All are reported actor tradecraft [S1]. Also check each device's syslog stream for gaps; a successful kill produces silence, not events.

Rogue Virtual FortiGate registration on FortiManager · FortiManager event / device management logs

index=* ("FMG-VMTM23017412" OR ("Virtual FortiGate" AND "localhost") OR ".tm") devid=* | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as msg by devname

A hit means: The serial or name of the rogue Virtual FortiGate seen by Unit 42 appears in your logs, or a .tm archive is referenced [S1]. Treat the FortiManager and every device it manages as in scope. Absence does not clear you; the actor may use other serials.

Verify

• Pull config revisions on each FortiGate. Look for system.auto-script objects containing ../, unexpected sniffer configs (TCP 3696-3706, UDP 69, 1812/1813, TCP 389), and admins or VPN groups that were created and then deleted [S1].
• Run 'diagnose debug crashlog read' and look for Signal 11 crashes in miglogd, iked or syslogd [S1].
• With vendor support, check /proc/<pid>/maps of miglogd and iked for anonymous 16,384-byte rwxp regions. Check the text offsets Unit 42 lists for 0xAA0003E0 patches [S1].
• Scan file and memory images with the Unit 42 YARA rule u42_apt_linux_PEERSTITCH_fortigate_implant [S1]. Compare files against the Unit 42 SHA-256 hashes.
• Look for /data2/template/ contents (pM.js, a.js, a.wasm, b.js, dd, index.js, index.wasm, ipssem.js, lldprx) and for /tmp/apache2/conf/md-acme.conf with the text '#0 certs managed by ACME' [S1].
• Check the Apache mod_md job.json for MDChallengeDns01 mapped to /bin/node, or SSH options pointing to 23.240.77.233:8084 [S1].

Scope

Affected

• FortiOS, FortiPAM, FortiProxy and FortiSwitchManager (CVE-2025-61624) [S3][S4]
• FortiManager (CVE-2024-47575), the initial access in this campaign [S1]
• FortiGates managed by a compromised FortiManager, whose configs and keys were exfiltrated [S1]

Only if

• CVE-2025-61624: the attacker is authenticated with an admin profile that has read-write permissions [S4]
• In this campaign, that access came from credentials taken via the compromised FortiManager [S1]

Not affected if

None stated by the sources.

Fixed in: See Fortinet FG-IR-26-122 [S6]. Fixed versions are not stated in the provided material.

Enumerate

• Every FortiOS, FortiPAM, FortiProxy, FortiSwitchManager and FortiManager instance, with its running version.
• For each FortiManager: all registered devices, any unknown Virtual FortiGates, .tm archives, and which FortiGates it manages.
• All admin accounts, VPN users and groups, including deleted ones visible in config revisions.
• Secrets stored in FortiGate configs: admin and VPN credentials, pre-shared keys, certificates, RADIUS/LDAP binds.
• Management and FGFM (TCP 541) exposure for each device, and which hosts each FortiGate accepts management connections from.
• Log retention per device, and gaps in syslog delivery.

Contain

• Before patching or rebooting, export config revisions, event logs and crashlogs. With vendor support, capture memory of miglogd and iked. PEERSTITCH lives in process memory; a reboot destroys those artifacts and cannot be undone [S1].
• Block 23.240.77.233, 47.18.167.159, 45.32.41.202 and 198.199.122.22 at egress and for SSL-VPN [S1].
• Block outbound SSH from firewall management addresses unless it is required [S1].
• Restrict management and FGFM access to known FortiManager and admin hosts, since the actor impersonated FortiManager [S1]. Remove internet exposure of FortiManager and admin interfaces.
• Disable unknown admins and VPN accounts. Remove unauthorized sniffer configs and rogue FortiManager device registrations [S1].
• If a FortiManager may be compromised, rotate every credential and key stored in FortiGate configs; the actor exfiltrated them [S1]. Data already taken stays exposed after rotation.
• Apply FG-IR-26-122 [S6] and the FortiManager fix for CVE-2024-47575. Where patching lags, check the interim mitigations in FG-IR-26-122 [S6].

Eradicate

• Remove auto-script objects with traversal names, the /data2/template/ components, and the md-acme.conf / mod_md job.json changes [S1].
• Clear injected code from miglogd and iked under vendor guidance; whether a reboot alone suffices is not stated [S1].
• Remove the rogue Virtual FortiGate from FortiManager, and any FortiGateCloud or other unknown admins [S1].
• Close the root causes: patch CVE-2024-47575 and CVE-2025-61624 and replace all exposed secrets [S1][S6].

Recover

• Before restoring, confirm patched firmware, a config matching a known-good baseline, and rotated secrets [S6].
• Confirm syslog flows continuously from each device to the collector, and that crashlogs are retained.
• Afterwards, keep the four hunts running. Alert on new auto-scripts, short-lived admins, sniffer config changes, outbound SSH from firewalls, unexpected FGFM peers and logging gaps [S1].

Re-enter the loop when

• Fortinet revises FG-IR-26-122 or publishes fixed versions or new indicators [S6].
• Unit 42 or another vendor publishes new IoCs, serials or infrastructure for CL-STA-0954 [S1].
• Any hunt hits on a device outside the first FortiManager's managed set.
• CVE-2024-26008 or CVE-2024-26009 is confirmed as exploited, or their role is explained.
• Evidence that PEERSTITCH survives reboot or firmware upgrade.

Debrief

• Record each device, version, patch date, evidence captured, and hunt results.
• Record which secrets were rotated and when, and any logging gaps found.
• Gap: no fixed versions in the provided material.
• Gap: the roles of CVE-2024-26008 and CVE-2024-26009 are not explained; one story calls CVE-2024-26008 an alias of FortiJump, which the sources do not support.
• Gap: whether PEERSTITCH survives a reboot is not stated.
• Gap: the mapping of SHA-256 hashes to individual component files is not given.

Detection coverage — checked automatically

Checked automatically 2026-10-31 23:30Z from public sources: 18 published, 27 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2024-47575

vuln:CVE-2024-26008

vuln:CVE-2025-61624

cpe:"cpe:/a:fortinet:fortimanager"

product:"Fortimanager"

host.services: (software.product = "Fortimanager")

cpe:"cpe:/a:fortinet:fortimanager_cloud"

product:"Fortimanager Cloud"

host.services: (software.product = "Fortimanager Cloud")

cpe:"cpe:/a:fortinet:fortiproxy"

product:"Fortiproxy"

host.services: (software.product = "Fortiproxy")

cpe:"cpe:/a:fortinet:fortiswitchmanager"

product:"Fortiswitchmanager"

host.services: (software.product = "Fortiswitchmanager")

NVD names 2 more affected products (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Banner spellings: a model read 5 from the NVD names and this card's text (former and marketing names, console titles); 0 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-31 23:30Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Date ordering is inconsistent: the brief date is 2026-10-15 but stories, the KEV listing (2026-10-16) and SecurityWeek (2026-10-20) are later. Confirm the brief date.
• The SecurityWeek link [S2] reportedly returned unrelated page content; its claims are uncorroborated.
• Are the IoCs (IPs, URLs, hashes) all from Unit 42 [S1]? The pipeline list does not attribute each one.
• What roles do CVE-2024-26008 and CVE-2024-26009 play in the chain?
• Which FortiOS, FortiPAM, FortiProxy and FortiSwitchManager versions are fixed?
• Is exploitation known beyond the one telecom MSP?
• The NGFW signature guidance has no source attached and was not used.

Sources

• [S1] https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/ · Unit 42
• [S2] https://www.securityweek.com/exploited-fortinet-bug-linked-to-stealthy-fortigate-implant-in-telecom-hack/ · SecurityWeek
• [S3] https://www.cisa.gov/known-exploited-vulnerabilities-catalog · CISA
• [S4] https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog · CISA
• [S5] https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html · The Hacker News
• [S6] https://fortiguard.fortinet.com/psirt/FG-IR-26-122 · FortiGuard Labs

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.