Hackers Took the Keys to 500 FortiGate Firewalls From One Fortinet Box, Then Hid Inside the Firewalls

One hacked management box was enough. Attackers broke into the central FortiManager of a telecommunications managed service provider and walked away with the configurations, credentials, private keys and IP addresses of more than 500 FortiGate firewalls guarding the provider and its clients.

Then they came back. Using those stolen passwords, they logged in like administrators, climbed to root and planted a new piece of malware called PEERSTITCH. It lives only in memory, opens no ports, makes no outbound connections and hides inside the firewall's own logging and VPN processes. Palo Alto Networks' Unit 42 laid out the intrusion on October 14. It began in September 2024.

One box, 500 firewalls

The way in was FortiJump, CVE-2024-47575, a critical flaw (CVSS 9.8) that lets an unauthenticated remote attacker run commands on FortiManager by sending crafted requests to its management channel on TCP port 541. The attackers registered a rogue virtual FortiGate named "localhost" from their own infrastructure, then generated and exfiltrated a configuration archive.

That archive was a master key ring. It held complete running configurations for more than 500 managed FortiGates, a list of their serial numbers and public IP addresses, network topology maps and routing tables, certificates and private keys, and admin, local and SSL VPN credentials stored as reversible ciphertext. "One compromised appliance yielded the cryptographic keys, credentials and network topology for more than 500 firewalls, including devices protecting client organizations," Unit 42 wrote.

Unit 42 only investigated the provider's own environment and did not examine the client networks. What is confirmed is the exposure of their configuration and credential material, not an intrusion into those clients.

Patience, then passwords

The attackers sat on their access for a long time. Eventually they used the FortiManager to push packet capture settings to several downstream firewalls, sniffing unencrypted HTTP and 11 specific services including TFTP, RADIUS and LDAP. Later captures on core perimeter firewalls targeted Active Directory queries.

Meanwhile, the stolen passwords could be brute-forced out of the configs, and Unit 42 confirmed they were. The attackers used those legitimate credentials to open SSL VPN sessions to perimeter firewalls, landing in internal management segments. It is the same lesson as FortiBleed, where stolen and reused passwords let attackers take over tens of thousands of Fortinet firewalls.

FortiOS admins normally have no shell. To get one, the attackers exploited CVE-2025-61624, a path traversal bug in an unsanitized "auto-script" object name in the FortiOS command line, which Fortinet patched in April 2026. That gave them root on the underlying operating system of a select number of firewalls.

How PEERSTITCH hides

PEERSTITCH is a 64-bit ARM Linux implant written in C. It runs once and patches the memory of two core FortiOS daemons: miglogd, which handles logging, and iked, the IPsec VPN daemon.

Inside them it builds a hidden bridge. The logging hook watches traffic for specific markers and hands a session tag to the VPN daemon. When a later VPN session carries that tag, the VPN hook takes a different path that skips FortiOS's default security checks. "PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections," Unit 42 wrote, which makes it resistant to conventional endpoint and network detection.

The attackers also kept a second door. They pointed the firewall's built-in Apache certificate module at their own server and injected shell commands into the domain name field of the certificate challenge. That spawned an SSH reverse shell that came back on every renewal cycle. They also impersonated the FortiManager to pull data from other managed firewalls.

Cleaning up

They covered their tracks carefully, stopping syslog generation, clearing crash logs, disrupting logging telemetry and automatically deleting rogue admin accounts and auto-script objects once they had run. "The attackers demonstrated proficiency in Fortinet appliance architecture, FortiOS internals and FortiOS management protocols," Unit 42 said. The group is tracked as CL-STA-0954, also known as UNC5820, and parts of its activity overlap with intrusions attributed to suspected nation-state actors.

Unit 42's larger warning is about architecture. Centralized management is supposed to make hundreds of firewalls easier to run. Here it made them easier to steal, and the researchers call it "the weaponization of centralized edge management ecosystems to compromise downstream networks."

Some offers on this page may be paid placements or contain affiliate links.