Changed since version 25

• Renumbered sources to this input: Unit 42 is now S1 (previously cited as S6 without a source entry), SecurityWeek S2, CISA KEV S3, CISA alert S4, The Hacker News S5, FortiGuard S6; all references remapped [S1-S6].
• Added Unit 42 as a listed source; Unit 42 details now cite S1 directly [S1].
• Confidence set to high on Unit 42 primary research plus CISA KEV [S1][S3][S4].
• Verify: added daemon text-patch check at the three published offsets and noted nine published SHA-256 hashes [S1].
• Verify: added benign look-alikes.
• Hunt 2 hit_means now notes pM.js served from 47.18.167.159:8085 as well [S1].
• Contain: consolidated the four campaign IPs under S1 [S1].
• Added eradicate steps, timeline, re-entry triggers and coverage checks [S1][S2][S4][S5][S6].
• Open questions: added story-date inconsistency and an unsourced NGFW guidance item.

What happened

• CL-STA-0954 exploited FortiJump (CVE-2024-47575) on a telecom MSP's FortiManager and registered a rogue Virtual FortiGate named localhost (serial FMG-VMTM23017412) [S1].
• The actor generated a .tm config archive and took configs, credentials and keys for 500+ managed FortiGates [S1].
• The actor pushed sniffer configs to managed FortiGates and opened SSL-VPN sessions with cracked credentials from staging infrastructure [S1].
• The actor used auto-script path traversal (CVE-2025-61624) to gain root and fetch five files from 23.240.77.233:8085 into /data2/template/ [S1].
• PEERSTITCH ptrace-injects into /bin/miglogd and /bin/iked to bypass validation on tagged VPN sessions. An Apache mod_md ACME job spawns SSH reverse shells [S1].
• CISA added CVE-2025-61624 to KEV on 2026-10-16 based on evidence of active exploitation [S3][S4].

Timeline

Detect

FortiGate auto-script objects with path traversal names · FortiOS system event / config change logs (syslog or FortiAnalyzer forward)

index=* devid=* type="event" subtype="system" (cfgpath="system.auto-script" OR msg="*auto-script*") (cfgobj="*../*" OR msg="*../*") | stats count min(_time) as first_seen max(_time) as last_seen values(action) as action values(cfgobj) as cfgobj values(msg) as msg by devname user ui

A hit means: An auto-script object with ../ in its name was created, edited or deleted. Unit 42 names ../../../../setup and ../../tmp/apache2/conf/md-acme.conf [S1]. Treat a hit as likely compromise. The actor deletes auto-scripts after use, so a delete event alone matters [S1].

Traffic, web or SSL-VPN sessions involving campaign infrastructure · FortiGate traffic, web filter and VPN event logs; proxy/egress logs

index=* (srcip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR dstip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR remip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR url="*/pM.js" OR (dstport=8085 (url="*/a.js" OR url="*/a.wasm" OR url="*/b.js" OR url="*/dd")) OR (dstport=8084 (url="*/acme/*" OR url="*/directory")) OR url="*/acme/new-acct*" OR url="*/acme/finalize/*" OR url="*/acme/order/*" OR url="*/acme/authz/*") | stats count min(_time) as first_seen max(_time) as last_seen values(dstport) as dstport values(url) as url values(action) as action values(user) as user by devname srcip dstip

A hit means: A device contacted campaign infrastructure. A fetch of pM.js, a.js, a.wasm, b.js or dd from port 8085 (23.240.77.233 or 47.18.167.159) matches the component download [S1]. Port 8084 /directory and /acme/ paths match the mod_md SSH reverse-shell channel [S1]. Inbound SSL-VPN logins from these IPs match stolen-credential use [S1]. ACME paths alone can be benign if the peer is not a campaign IP.

Logging daemons killed, crashlogs cleared, or FortiGateCloud admin activity · FortiOS CLI audit and system event logs

index=* devid=* (msg="*killall*miglogd*" OR msg="*killall*syslogd*" OR msg="*crashlog clear*" OR user="FortiGateCloud") | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as msg values(ui) as ui by devname user

A hit means: Someone stopped logging or cleared crash logs, matching the actor's log tampering [S1]. An admin named FortiGateCloud pulling running configs over FGFM matches the FortiManager impersonation [S1]. Also check each device's syslog stream for gaps; a successful kill produces silence, not events.

Rogue Virtual FortiGate registration on FortiManager · FortiManager event / device management logs

index=* ("FMG-VMTM23017412" OR ("Virtual FortiGate" AND "localhost") OR ".tm") devid=* | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as msg by devname

A hit means: The rogue Virtual FortiGate (localhost, serial FMG-VMTM23017412) appears, or a .tm archive is referenced [S1]. Treat the FortiManager and every device it manages as in scope. Absence does not clear you; the actor may use other serials. The bare .tm term is noisy, so confirm by context.

Verify

• Pull config revisions on each FortiGate. Look for auto-script objects containing ../ and for admins or VPN groups created and then deleted [S1].
• Run diagnose debug crashlog read. Signal 11 crashes in miglogd, iked or syslogd are a reported indicator [S1].
• pM.js deletes itself, so its absence does not clear a device [S1]. Check /data2/template/ for leftover lldprx, ipssem.js, index.js and index.wasm [S1].
• Hash recovered files against Unit 42's published SHA-256 values (nine listed) and scan with YARA rule u42_apt_linux_PEERSTITCH_fortigate_implant [S1].
• Inspect Apache mod_md job.json for MDChallengeDns01 mapped to /bin/node, and SSH arguments such as kali@23.240.77.233:8084 with -F /tmp/upfile/ssh_config [S1].
• Check /proc/<pid>/maps of /bin/miglogd and /bin/iked for anonymous 16,384-byte rwxp regions, and audit /proc/<pid>/mem writes between them [S1].

Scope

Affected

• FortiOS, FortiPAM, FortiProxy and FortiSwitchManager (CVE-2025-61624) [S3][S4]
• FortiManager (CVE-2024-47575), the initial access in this campaign [S1]
• FortiGates managed by a compromised FortiManager, whose configs and keys were exfiltrated [S1]

Only if

• CVE-2025-61624 requires an authenticated attacker with an admin profile that has read-write permissions, who can then write or delete arbitrary files via specific CLI commands [S3][S4].
• In this campaign, that access followed credentials and keys taken via the compromised FortiManager [S1].

Not affected if

None stated by the sources.

Fixed in: See Fortinet FG-IR-26-122 [S6]. The provided material does not state fixed versions.

Enumerate

• List every FortiOS, FortiPAM, FortiProxy, FortiSwitchManager and FortiManager instance, with its running version.
• For each FortiManager, list registered devices, unknown Virtual FortiGates, .tm archives, and the FortiGates it manages [S1].
• List all admin accounts, VPN users and groups, including deleted ones visible in config revisions [S1].
• List sniffer configs on FortiGates, especially those capturing TCP 3696-3706, UDP 69, 1812/1813 or TCP 389 [S1].
• List secrets stored in FortiGate configs: admin and VPN credentials, pre-shared keys, certificates, and RADIUS/LDAP binds [S1].
• Map management and FGFM (TCP 541) exposure per device, and the hosts each FortiGate accepts management connections from [S1].

Contain

• Before patching or rebooting, export config revisions, event logs and crash logs. With vendor support, capture memory of miglogd and iked, where PEERSTITCH runs [S1]. A reboot destroys in-memory artifacts and cannot be undone.
• Block 23.240.77.233, 47.18.167.159, 45.32.41.202 and 198.199.122.22 at egress and for SSL-VPN [S1].
• Block outbound SSH from firewall management addresses unless required. The actor used mod_md to spawn SSH reverse shells [S1].
• Restrict management and FGFM access to known FortiManager and admin hosts. Remove internet exposure of FortiManager and admin interfaces.
• Disable unknown admins and VPN accounts. Remove unauthorized sniffer configs and rogue FortiManager device registrations [S1].
• If a FortiManager may be compromised, rotate every credential and key stored in FortiGate configs [S1]. Rotation does not undo exposure of data already taken.
• Apply FG-IR-26-122 and the FortiManager fix for CVE-2024-47575. Where patching lags, confirm FortiGuard virtual patch FG-VD-59270.0day (FMWP db 25.120) is in place [S6].

Eradicate

• Remove auto-script objects with traversal names, rogue admins, VPN groups and sniffer configs [S1].
• Remove /data2/template/ components (lldprx, ipssem.js, index.js, index.wasm) and the mod_md job.json entry mapping MDChallengeDns01 to /bin/node [S1].
• Clear injected code from miglogd and iked with vendor guidance; the sources do not say whether a reboot alone suffices [S1].
• Close root cause: patch CVE-2024-47575 on FortiManager and CVE-2025-61624 on affected products [S1][S6].

Recover

• Before restoring, confirm patched firmware, a config matching a known-good baseline, and rotated secrets [S6].
• Confirm syslog flows continuously from each device and crash logs are retained [S1].
• Confirm no 16KB rwxp regions remain in miglogd and iked, and that the published YARA rule finds nothing [S1].
• Afterwards, keep the four hunts running. Alert on new auto-scripts, short-lived admins, sniffer config changes, outbound SSH from firewalls, unexpected FGFM peers and logging gaps [S1].

Re-enter the loop when

• Fortinet updates FG-IR-26-122 with fixed versions or new affected products [S6].
• New IoCs, hashes or C2 addresses are published beyond the current set [S1].
• Any hunt hits on a FortiManager: every managed FortiGate enters scope [S1].
• A source confirms or refutes the roles of CVE-2024-26008 or CVE-2024-26009 [S2][S5].
• A source states whether PEERSTITCH survives reboot.

Debrief

• Record each device, version, patch date, evidence captured and hunt results.
• Record which secrets were rotated and when, and any logging gaps found.
• Record VPN sessions that could not be validated, given the iked bypass [S1].
• Gap: the provided material does not state fixed versions.
• Gap: the roles of CVE-2024-26008 and CVE-2024-26009 are unexplained. One story calls CVE-2024-26008 a FortiJump alias, but SecurityWeek's linked content could not be read [S2].
• Gap: the sources do not say whether PEERSTITCH survives a reboot.

Detection coverage — checked automatically

Checked automatically 2026-11-01 13:47Z from public sources: 18 published, 27 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2024-47575

vuln:CVE-2024-26008

vuln:CVE-2025-61624

cpe:"cpe:/a:fortinet:fortimanager"

product:"Fortimanager"

host.services: (software.product = "Fortimanager")

cpe:"cpe:/a:fortinet:fortimanager_cloud"

product:"Fortimanager Cloud"

host.services: (software.product = "Fortimanager Cloud")

cpe:"cpe:/a:fortinet:fortiproxy"

product:"Fortiproxy"

host.services: (software.product = "Fortiproxy")

cpe:"cpe:/a:fortinet:fortiswitchmanager"

product:"Fortiswitchmanager"

host.services: (software.product = "Fortiswitchmanager")

http.title:"FortiManager"

http.title:"FortiProxy"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD names 2 more affected products (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Banner spellings: a model read 5 from the NVD names and this card's text (former and marketing names, console titles); 2 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-01 13:47Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Which fixed versions does FG-IR-26-122 list? The provided material does not state them.
• What is the role of CVE-2024-26008 and CVE-2024-26009? Sources disagree or are silent.
• Does PEERSTITCH persist across reboot or firmware upgrade?
• Story dates are inconsistent: the item marked today is dated 2026-10-15 (the brief date), while other items are dated 2026-10-16 to 2026-10-20 and KEV listing is 2026-10-16. The timeline uses the dates as given.
• One published guidance item references NGFW signatures for CVE-2024-47575 with no traceable source; it is omitted.
• SecurityWeek's linked page returned unrelated content, so its reporting is uncorroborated [S2].

Sources

• [S1] https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/ · Unit 42
• [S2] https://www.securityweek.com/exploited-fortinet-bug-linked-to-stealthy-fortigate-implant-in-telecom-hack/ · SecurityWeek
• [S3] https://www.cisa.gov/known-exploited-vulnerabilities-catalog · CISA
• [S4] https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog · CISA
• [S5] https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html · The Hacker News
• [S6] https://fortiguard.fortinet.com/psirt/FG-IR-26-122 · FortiGuard Labs

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.