PEERSTITCH Malware Reached 500 FortiGate Firewalls Via FortiOS Flaw

PEERSTITCH malware reached more than 500 downstream firewalls after attackers broke into a telecom provider's FortiManager appliance, according to Palo Alto Networks Unit 42. The attackers stole configurations, cryptographic material and databases for the managed devices. They then used a separate Fortinet flaw to take root on a FortiGate firewall. CISA added that flaw, CVE-2025-61624, to its Known Exploited Vulnerabilities catalog on Friday, October 16.

For US firewall operators, the listing is a signal to act. It confirms that the bug is being used in real attacks, and it puts federal civilian agencies under a patch deadline. Managed-service providers and their customers carry the most direct risk, because one compromised management console can expose many firewalls at once.

How the telecom breach reached 500 firewalls

Unit 42 says the intrusion began with CVE-2024-47575, a separate FortiManager flaw. FortiManager is the central console many providers use to administer customer firewalls, which made it a valuable target. Once inside, the attackers took an archive holding running configurations, keys and databases for more than 500 managed FortiGate devices.

Unit 42 researchers described the theft in words that Security Affairs quoted: "from that single appliance, our observations are that the attackers exfiltrated an archive containing running configurations."

That sentence explains the scale. One management appliance held the configuration data for hundreds of customer networks, so a single breach supplied material for many downstream targets. Unit 42 limited its investigation to the provider's own environment, which means its findings do not cover downstream clients.

Public reporting does not say how many of those 500 devices were actually implanted. One analysis states that no count has been published. Treat 500 as the number of firewalls whose data was exposed, not a confirmed infection total.

How PEERSTITCH malware hides inside FortiGate firewalls

After the data theft, the attackers exploited CVE-2025-61624, a path traversal flaw in the FortiOS auto-script engine. That gave them root on the firewall operating system, where they deployed PEERSTITCH. Unit 42 describes the implant as a memory-resident ARM64 program that leaves no persistent binary on disk.

PEERSTITCH also opens no listening ports and makes no outbound connections of its own. It hides inside legitimate traffic, which makes simple file scans and port checks unlikely to catch it. Defenders will have to rely on indicators of compromise and unusual device behavior.

The attackers did not stop at the implant. According to CyberPress, they used stolen configurations to recover administrative and SSL/VPN passwords, then set up unauthorized VPN sessions. Valid credentials let an intruder return without exploiting anything new, so the password theft may matter as much as the malware for many organizations.

Palo Alto Networks attributes the activity to a cluster it tracks as UNC5820, according to SecurityWeek. SecurityWeek's summary describes the activity as state-sponsored, while Rewterz calls the actor a "suspected advanced threat actor." No government has attributed the activity to a specific country in the reporting available so far.

Which Fortinet products and versions are affected

Fortinet published advisory FG-IR-26-122 on April 14, 2026, and patched the flaw that month. One advisory summary cited by Rewterz names FortiOS, FortiPAM, FortiProxy and FortiSwitchManager as affected products. Read the advisory for the fixed builds on your own branch instead of relying on secondary summaries.

The dates do not line up cleanly. Unit 42 places the intrusion in September 2024, but the advisory and CVE record put public disclosure in April 2026. If both are accurate, the activity predates disclosure by about 19 months, and public reporting has not resolved the gap.

Severity is also contested. Fortinet scores the flaw 6.0 and NIST scores it 6.5, while Rewterz and SecNews cite 5.4. A medium score can push a patch down the queue, but KEV inclusion means exploitation has already been observed. Rank this flaw by your exposure, not by the number.

Why CISA's deadline and the wider KEV wave matter

CISA urged federal agencies to patch the flaw immediately. SC World reports a federal remediation date of October 19, 2026, which is today. That date appears in only one secondary report so far, so confirm it on CISA's catalog entry before relying on it.

This is not the only edge-device problem on the list this month. CISA's recent updates also included a BeyondTrust Remote Support flaw, and PAN-OS and Cisco gateway flaws were added on October 14.

Unit 42 describes the weaponizing of centralized edge-management systems as a growing threat. Firewalls, VPN gateways and management consoles sit at the network perimeter and hold credentials, which is why attackers keep returning to them. The same design that lets a provider manage hundreds of firewalls from one console lets an intruder reach them all.

For a similar root-access risk on a different device class, read our report on a Broadcom Wi-Fi flaw that lets nearby attackers get root on routers. For another recent patch that targets exposed servers, see our coverage of Nextcloud CVE-2026-110447.

Steps to check and secure your FortiGate devices

• Inventory every FortiOS, FortiManager, FortiProxy, FortiPAM and FortiSwitchManager device, including any your provider manages for you.
• Compare each version against advisory FG-IR-26-122 and apply the April 2026 fixes.
• If a device was ever managed through an exposed FortiManager, treat its administrative and SSL/VPN credentials as possibly exposed and rotate them.
• Hunt for port marker 8550 and IP 169.254.0.1, and review the miglogd and iked processes for abnormal behavior. The address sits in the IPv4 link-local range, so treat a match as a lead to investigate rather than proof of compromise.
• Check for unauthorized packet-capture settings and unexpected configuration changes on managed firewalls.
• Review active VPN sessions and remove any you did not create.
• Ask your managed-service provider in writing whether its FortiManager was affected and what it has done about it.

What to watch next

Several open questions will shape how defenders respond. Fortinet or NIST may settle the severity score, and a revised rating would change how quickly smaller teams treat the flaw. Unit 42 or another researcher may publish a downstream victim count, which is the number every managed-service customer will want to see.

Any government attribution would also move UNC5820 from a cluster name to a policy question. Until then, the safest assumption for anyone who ran FortiGate firewalls through a managed console is that their configurations and credentials were in scope.