PEERSTITCH implant tags FortiOS VPN sessions to skip security checks

Unit 42 at Palo Alto Networks published research on October 14 about PEERSTITCH, a memory-resident FortiOS implant found during an intrusion at a telecommunications provider that began in September 2024. The actor, tracked as CL-STA-0954 or UNC5820, got in through the FortiManager flaw CVE-2024-47575, then used CVE-2025-61624, a CLI path traversal letting a read-write administrator write files as root, to plant the implant. PEERSTITCH attaches to the miglogd and iked daemons; when iked sees a VPN session carrying its tag, it takes a branch that skips default FortiOS security validations. CISA added CVE-2025-61624 (Fortinet CVSS 6.0) to its KEV catalog on October 16, due October 19. FortiOS 7.6.5 and 7.4.10 fix it; 7.2, 7.0 and 6.4 need migration.

Why it matters

An implant inside the IKE daemon decides which VPN sessions get checked, so authentication logs on the firewall stop being evidence of who connected. The data theft matters more: running configurations for over 500 managed FortiGates, administrative, local and SSL VPN credentials stored as reversible ciphertext that the attackers recovered, and certificates with private keys.

Unit 42's advice is to treat the credentials and certificates these devices hold as compromised. That means rotating VPN user passwords and admin accounts, reissuing VPN and admin certificates, and moving remote access to phishing-resistant MFA so a recovered password is not enough. It is the same lesson as FortiBleed: firewall admin access is a credential store.

Source: The Hacker News