Changed since version 27

• Renumbered sources to this run's list: Unit 42 is now S1 and is listed as a source; SecurityWeek S2; CISA KEV S3; CISA alert S4; The Hacker News S5; FG-IR-26-122 S6. Citations throughout were updated [S1].
• Confidence reason now cites Unit 42's primary research directly [S1][S3][S4].
• Hunt 2 hit_means: 47.18.167.159:8085 also serves pM.js [S1].
• Verify: added check of daemon text offsets for 0xAA0003E0 patches and /proc/<pid>/mem audit [S1].
• Verify: added benign look-alikes.
• Added eradicate, re-enter, coverage-check, timeline and open-question entries, including the unsourced IPS signature claim and the date inconsistency [S1][S6].

What happened

• CL-STA-0954 (UNC5820) exploited FortiJump (CVE-2024-47575) on a telecom MSP's FortiManager. It registered a rogue Virtual FortiGate named localhost and created a .tm config archive [S1].
• The actor took configs, credentials and keys for 500+ managed FortiGates. It used cracked credentials for SSL-VPN sessions from its staging infrastructure [S1][S5].
• It abused CVE-2025-61624 auto-script path traversal (../../../../setup) to get root. It then pulled five files from 23.240.77.233:8085 into /data2/template/ [S1].
• PEERSTITCH ptrace-injects into /bin/miglogd and /bin/iked. This bypasses validation for tagged VPN sessions. An Apache mod_md ACME hook spawned SSH reverse shells [S1].
• The actor killed miglogd and syslogd, cleared crash logs, and deleted rogue admins, VPN groups and auto-scripts after use [S1].
• CISA added CVE-2025-61624 to KEV on 2026-10-16 based on evidence of active exploitation [S3][S4].

Timeline

Detect

FortiGate auto-script objects with path traversal names · FortiOS system event / config change logs (syslog or FortiAnalyzer forward)

index=* devid=* type="event" subtype="system" (cfgpath="system.auto-script" OR msg="*auto-script*") (cfgobj="*../*" OR msg="*../*") | stats count min(_time) as first_seen max(_time) as last_seen values(action) as action values(cfgobj) as cfgobj values(msg) as msg by devname user ui

A hit means: An auto-script object with ../ in its name was created, edited or deleted. Unit 42 names ../../../../setup and ../../tmp/apache2/conf/md-acme.conf [S1]. Treat a hit as likely compromise. The actor deletes auto-scripts after use, so a delete event alone matters [S1].

Traffic, web or SSL-VPN sessions involving campaign infrastructure · FortiGate traffic, web filter and VPN event logs; proxy/egress logs

index=* (srcip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR dstip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR remip IN ("23.240.77.233","47.18.167.159","45.32.41.202","198.199.122.22") OR url="*/pM.js" OR (dstport=8085 (url="*/a.js" OR url="*/a.wasm" OR url="*/b.js" OR url="*/dd")) OR (dstport=8084 (url="*/acme/*" OR url="*/directory")) OR url="*/acme/new-acct*" OR url="*/acme/finalize/*" OR url="*/acme/order/*" OR url="*/acme/authz/*") | stats count min(_time) as first_seen max(_time) as last_seen values(dstport) as dstport values(url) as url values(action) as action values(user) as user by devname srcip dstip

A hit means: A device contacted campaign infrastructure. A fetch of pM.js from 23.240.77.233:8085 or 47.18.167.159:8085, or of a.js, a.wasm, b.js or dd on port 8085, matches the component download [S1]. Port 8084 /directory and /acme/ paths match the mod_md SSH reverse shell [S1]. Inbound SSL-VPN logins from these IPs match stolen-credential use [S1]. ACME paths alone can be benign if the peer is not a campaign IP.

Logging daemons killed, crashlogs cleared, or FortiGateCloud admin activity · FortiOS CLI audit and system event logs

index=* devid=* (msg="*killall*miglogd*" OR msg="*killall*syslogd*" OR msg="*crashlog clear*" OR user="FortiGateCloud") | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as msg values(ui) as ui by devname user

A hit means: Someone stopped logging or cleared crash logs, matching the actor's log tampering [S1]. An admin named FortiGateCloud pulling running configs matches the FortiManager impersonation [S1]. Also check each device's syslog stream for gaps. A successful kill produces silence, not events.

Rogue Virtual FortiGate registration on FortiManager · FortiManager event / device management logs

index=* ("FMG-VMTM23017412" OR ("Virtual FortiGate" AND "localhost") OR ".tm") devid=* | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as msg by devname

FROM logs-* | WHERE observer.serial_number IS NOT NULL AND (message LIKE "*FMG-VMTM23017412*" OR (message LIKE "*Virtual FortiGate*" AND message LIKE "*localhost*") OR message LIKE "*.tm*") | STATS count = COUNT(*), first_seen = MIN(@timestamp), last_seen = MAX(@timestamp), msg = VALUES(message) BY observer.name

A hit means: The rogue Virtual FortiGate (localhost, serial FMG-VMTM23017412) appears, or a .tm archive is referenced [S1]. Treat that FortiManager and every device it manages as in scope. Absence does not clear you, because the actor may use other serials. The bare .tm term is noisy, so confirm by context.

Verify

• Pull config revisions on each FortiGate. Look for auto-script objects containing ../ and for admins or VPN groups that were created and then deleted [S1].
• Run diagnose debug crashlog read. Signal 11 crashes in miglogd, iked or syslogd are a reported indicator [S1].
• pM.js deletes itself, so its absence does not clear a device [S1][S5]. Check /data2/template/ for leftover lldprx, ipssem.js, index.js and index.wasm [S1].
• Hash recovered files against Unit 42's published SHA-256 values. Scan them with YARA rule u42_apt_linux_PEERSTITCH_fortigate_implant [S1].
• Inspect Apache mod_md job.json for MDChallengeDns01 mapped to /bin/node. Look for SSH arguments such as kali@23.240.77.233:8084 with -F /tmp/upfile/ssh_config [S1].
• Check /proc/<pid>/maps of /bin/miglogd and /bin/iked for anonymous 16,384-byte rwxp regions [S1].

Scope

Affected

• FortiOS, FortiPAM, FortiProxy and FortiSwitchManager (CVE-2025-61624) [S3][S4]
• FortiManager (CVE-2024-47575), the initial access in this campaign [S1]
• FortiGates managed by a compromised FortiManager, whose configs and keys were exfiltrated [S1]

Only if

• CVE-2025-61624 requires an authenticated attacker with an admin profile that has read-write permissions. That attacker can then write or delete arbitrary files via specific CLI commands [S3][S4].
• In this campaign, that access followed configs, credentials and keys taken via the compromised FortiManager [S1].

Not affected if

None stated by the sources.

Fixed in: See Fortinet FG-IR-26-122 [S6]. The provided material does not state fixed versions.

Enumerate

• List every FortiOS, FortiPAM, FortiProxy, FortiSwitchManager and FortiManager instance, with its running version.
• For each FortiManager, list registered devices, unknown Virtual FortiGates, .tm archives, and the FortiGates it manages [S1].
• List all admin accounts, VPN users and groups, including deleted ones visible in config revisions [S1].
• List sniffer configs on FortiGates, especially those capturing TCP 3696-3706, UDP 69, 1812/1813 or TCP 389 [S1].
• List secrets stored in FortiGate configs: admin and VPN credentials, pre-shared keys, certificates, and RADIUS/LDAP binds [S1].
• Map management and FGFM (TCP 541) exposure per device, and the hosts each FortiGate accepts management connections from [S1].

Contain

• Before patching or rebooting, export config revisions, event logs and crash logs. With vendor support, capture memory of miglogd and iked, where PEERSTITCH runs [S1]. A reboot destroys in-memory artifacts and cannot be undone.
• Block 23.240.77.233, 47.18.167.159, 45.32.41.202 and 198.199.122.22 at egress and for SSL-VPN [S1].
• Block outbound SSH from firewall management addresses unless required. The actor used mod_md to spawn SSH reverse shells [S1].
• Restrict management and FGFM access to known FortiManager and admin hosts. Remove internet exposure of FortiManager and admin interfaces.
• Disable unknown admins and VPN accounts. Remove unauthorized sniffer configs and rogue FortiManager device registrations [S1].
• Terminate active SSL-VPN sessions on suspect devices. The iked hook can bypass validation for tagged sessions [S1].
• If a FortiManager may be compromised, rotate every credential and key stored in FortiGate configs [S1]. Rotation does not undo exposure of data already taken.
• Apply FG-IR-26-122 and the FortiManager fix for CVE-2024-47575. Where patching lags, confirm FortiGuard virtual patch FG-VD-59270.0day (FMWP db 25.120) is in place [S6].

Eradicate

• Remove auto-script objects with ../ names and any files they dropped in /data2/template/ (lldprx, ipssem.js, index.js, index.wasm) [S1].
• Remove the mod_md job.json hook that maps MDChallengeDns01 to /bin/node, and any /tmp/upfile/ssh_config [S1].
• Remove rogue admins, VPN groups, sniffer configs and the rogue Virtual FortiGate registration [S1].
• Clear injected code from miglogd and iked by reimaging with fixed firmware from a trusted source. Treat in-place cleanup as unproven [S1][S6].
• Close the root causes: patch CVE-2024-47575 on FortiManager and CVE-2025-61624 on affected products [S3][S6].

Recover

• Before restoring, confirm patched firmware, a config matching a known-good baseline, and rotated secrets [S6].
• Confirm syslog flows continuously from each device and that crash logs are retained [S1].
• Confirm no 16KB rwxp regions remain in miglogd and iked, and that the published YARA rule finds nothing [S1].
• Afterwards, keep the four hunts running. Alert on new auto-scripts, short-lived admins, sniffer config changes, outbound SSH from firewalls, unexpected FGFM peers and logging gaps [S1].

Re-enter the loop when

• New campaign IPs, hashes or component URLs are published, as with 47.18.167.159 also serving pM.js [S1].
• Fortinet updates FG-IR-26-122 with fixed versions, new affected products, or a changed exploitation status [S6].
• A hit appears on any FortiGate managed by a FortiManager you had not scoped.
• A source confirms or rules out the role of CVE-2024-26008 or CVE-2024-26009.
• Evidence shows PEERSTITCH survives reboot or firmware upgrade.

Debrief

• Record each device, version, patch date, evidence captured and hunt results.
• Record which secrets were rotated and when, and any logging gaps found.
• Record VPN sessions that could not be validated, given the iked bypass [S1].
• Gap: the provided material does not state fixed versions.
• Gap: the roles of CVE-2024-26008 and CVE-2024-26009 are unexplained. One story calls CVE-2024-26008 a FortiJump alias, but SecurityWeek's linked content could not be read [S2].
• Gap: the sources do not say whether PEERSTITCH survives a reboot.

Detection coverage — checked automatically

Checked automatically 2026-11-11 21:13Z from public sources: 15 published, 27 nothing found, 0 not machine-checkable, 3 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2024-26009 — PEERSTITCH: memory-resident ARM64 FortiGate implant after FortiManager CVE-2024-47575 compromise; CVE-2024-47575 — PEERSTITCH: memory-resident ARM64 FortiGate implant after FortiManager CVE-2024-47575 compromise; CVE-2025-61624 — PEERSTITCH: memory-resident ARM64 FortiGate implant after FortiManager CVE-2024-47575 compromise. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2024-47575

vuln:CVE-2025-61624

vuln:CVE-2024-26009

http.title:"FortiManager"

http.title:"FortiProxy"

http.title:"FortiGate"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD has not published CPE configurations for these CVEs yet, so only the CVE query is exact; the product queries use the name the campaign gives (FortiOS, FortiManager) and are replaced by NVD's spelling at the daily re-check once it names the software.

Also tried under the name the card uses, nothing matched on Shodan: product:"FortiOS", http.component:"FortiOS", product:"FortiManager", http.component:"FortiManager", host.services: (software.product = "FortiOS"), host.services: (software.product = "FortiManager").

Banner spellings: a model read 5 from the NVD names and this card's text (former and marketing names, console titles); 3 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-11 21:13Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Which fixed versions does FG-IR-26-122 list? The provided material does not say.
• Is CVE-2024-26008 an alias for FortiJump, and what is CVE-2024-26009's role? Only an unreadable SecurityWeek page and story summaries assert this.
• The brief date (2026-10-15) precedes the KEV listing (2026-10-16) and later stories; confirm the correct publication dates.
• The published guidance names PAN Threat Prevention signatures 95788 and 96788 for CVE-2024-47575 without a source; not used in the card.
• Does PEERSTITCH persist across reboot or firmware upgrade?

Sources

• [S1] https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/ · Unit 42
• [S2] https://www.securityweek.com/exploited-fortinet-bug-linked-to-stealthy-fortigate-implant-in-telecom-hack/ · SecurityWeek
• [S3] https://www.cisa.gov/known-exploited-vulnerabilities-catalog · CISA
• [S4] https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog · CISA
• [S5] https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html · The Hacker News
• [S6] https://fortiguard.fortinet.com/psirt/FG-IR-26-122 · FortiGuard Labs

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.