Fortinet Management Plane Exploitation and PEERSTITCH Deployment

Source

---
analysis: A single rule might find the rogue IPs, but this hunt connects the initial
  management-plane breach to a multi-stage persistence and deployment chain targeting
  specific ARM64 firewall daemons, requiring cross-surface correlation between vulnerability,
  network, and process activity.
blind_spots:
- id: memory-hook-blind-spot
  question: whether PEERSTITCH has successfully patched daemons in memory
  requires: ptrace and memory allocation telemetry
  risk: The implant resides only in memory and uses existing processes for C2; if
    the initial injector process (lldprx) is not captured, the implant is invisible
    to standard process/file queries.
  stage: defense-evasion-memory-injection
- id: fortios-auto-script-logging
  question: whether the auto-script traversal succeeded in dropping files
  requires: FortiOS auto-script execution logs
  risk: Management plane logs may record object creation but not the low-level path
    traversal that drops the malware payload if logging levels are default.
  stage: privilege-escalation-path-traversal
coverage:
- stage: initial-access-fortimanager-exploit
  status: covered
  steps:
  - vulnerability-scoping
  - rogue-fmg-access
- stage: exfiltration-configuration-archive
  status: covered
  steps:
  - rare-config-archive-touches
- stage: persistence-unauthorized-vpn-access
  status: covered
  steps:
  - unauthorized-vpn-logons
- stage: privilege-escalation-path-traversal
  status: covered
  steps:
  - peerstitch-deployment
- stage: defense-evasion-memory-injection
  status: covered
  steps:
  - peerstitch-deployment
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: promote-to-detection
  justification: The theft of central management configurations exposes the entire
    perimeter security architecture. Detecting the PEERSTITCH implant is required
    to prevent long-term credential interception across the managed estate.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An attacker has exploited a central management appliance to exfiltrate
  configurations and then used stolen credentials to deploy a memory-resident ARM64
  implant on managed firewalls.
labels:
- hunt
- attack.t1190
- attack.t1041
- attack.t1133
- attack.t1071
- defense evasion
- execution
- exfiltration
- initial access
- persistence
name: Fortinet Management Plane Exploitation and PEERSTITCH Deployment
parameters:
  attacker_ips_initial:
    default:
    - 45.32.41.202
    - 198.199.122.22
    description: IPs observed performing rogue FortiManager registration.
    from:
      kind: article
      observed: '2024-10-14'
      ref: unit42-peerstitch
    type: list[ip]
  attacker_ips_vpn:
    default:
    - 23.240.77.233
    - 47.18.167.159
    description: IPs observed establishing unauthorized SSL/VPN sessions.
    from:
      kind: article
      observed: '2024-10-14'
      ref: unit42-peerstitch
    type: list[ip]
  lookback_days:
    default: '14'
    description: Days of history to examine.
    type: number
  scope_hosts:
    default: []
    description: Target hosts identified by the scoping step.
    type: list[host]
  vulnerability_ids:
    default:
    - CVE-2024-47575
    - CVE-2025-61624
    description: CVEs for FortiManager auth bypass and FortiOS path traversal.
    from:
      kind: article
      observed: '2024-10-14'
      ref: unit42-peerstitch
    type: list[string]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: Start with centralized FortiManager instances as identifying the breach
  here is the first link. Widen to perimeter firewalls using the hosts returned by
  the scoping step to identify subsequent implantation.
references:
- name: "Unit 42 \u2014 Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant"
  url: https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
related:
- hunt: fortios-configuration-integrity-monitor
  reason: This hunt focuses on PEERSTITCH deployment; a separate hunt should monitor
    for unauthorized sniffer configuration changes.
  relation: out-of-scope-alternative
scenario:
  stages:
  - name: FortiManager Exploitation and Rogue Registration
    observables:
    - CVE-2024-47575
    - TCP port 541 (FMG-Access)
    - 'Rogue device serial: FMG-VMTM23017412'
    - 'Rogue device name: localhost'
    - 'Source IPs: 45.32.41.202, 198.199.122.22'
    slug: initial-access-fortimanager-exploit
    tactic: initial-access
    techniques:
    - T1190
  - name: Database and Configuration Exfiltration
    observables:
    - 'Archive file: .tm'
    - 'Database files: global.db, revinfo.db'
    - Configuration for over 500 managed FortiGate firewalls
    slug: exfiltration-configuration-archive
    tactic: exfiltration
    techniques:
    - T1041
  - name: Credential-based VPN Persistence
    observables:
    - 'Source IPs: 23.240.77.233, 47.18.167.159'
    - SSL/VPN sessions to perimeter firewalls
    - Usage of administrative credentials recovered from exfiltrated configs
    slug: persistence-unauthorized-vpn-access
    tactic: persistence
    techniques:
    - T1133
  - name: FortiOS Path Traversal and PEERSTITCH Deployment
    observables:
    - CVE-2025-61624
    - 'Object name: ../../../../setup'
    - auto-script engine exploitation
    - 'Directory: /data2/template/'
    - 'Malware files: pM.js, index.js, index.wasm, ipssem.js, lldprx'
    slug: privilege-escalation-path-traversal
    tactic: execution
    techniques:
    - T1190
  - name: PEERSTITCH Memory-Resident Injection
    observables:
    - 'Process injection targets: /bin/miglogd, /bin/iked'
    - ptrace(PTRACE_SEIZE, pid) usage
    - Writing to /proc/<pid>/mem
    - 'Memory patches at static offsets: base + 0x106F7B8, base + 0x1072E20, base
      + 0x109A570'
    - 20-byte trampoline at base + 0x135102C
    - In-memory marker search for '8550' and '169.254.0.1'
    slug: defense-evasion-memory-injection
    tactic: defense-evasion
    techniques:
    - T1071
  summary: Attackers exploited CVE-2024-47575 on FortiManager to register rogue appliances
    and exfiltrate configuration archives containing credentials for over 500 managed
    firewalls. They subsequently used these credentials to establish VPN sessions
    and exploit CVE-2025-61624 for privilege escalation, ultimately deploying PEERSTITCH,
    a memory-resident ARM64 implant that intercepts traffic and bypasses security
    validations via process injection.
severity: critical
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  identity:
    category: identity
    name: Identity / sign-in telemetry
    telemetry:
    - identity
  network:
    category: network
    name: Network telemetry
    telemetry:
    - network
tlp: clear
type: investigation
---


# Fortinet Management Plane Exploitation and PEERSTITCH Deployment

This hunt targets the multi-stage exploitation of Fortinet infrastructure. It starts by identifying vulnerable appliances and rogue device registrations used for configuration exfiltration. It then pivots to find unauthorized VPN access from known actor infrastructure and the deployment of PEERSTITCH, a memory-resident injector that intercepts traffic by patching core daemons. The hunt correlates initial management-plane compromise with follow-on persistence on perimeter firewalls using a phased approach.

## vulnerability-scoping
<!-- Vulnerability identification -->
Identify appliances currently reporting vulnerabilities used in the PEERSTITCH campaign.

```sqlite target=endpoint role=scoping params=(vulnerability_ids=vulnerability_ids)
~~~yaml
expected: A list of unique device IDs exposed to management plane or path traversal
  exploits. Silence indicates no reported findings.
reads:
- device_uid
- resource_uid
- cve_uid
- severity_id
- status
silence: not_evidence_of_absence
source: hb_vulnerability_finding
verified: dry-run
verified_at: '2026-10-15'
~~~
SELECT device_uid, resource_uid, cve_uid, severity_id, status FROM hb_vulnerability_finding WHERE instr(',' || '{{vulnerability_ids}}' || ',', ',' || cve_uid || ',') > 0
```

## early-stage-corroboration
<!-- Corroborate rogue access and rare exfiltration -->
parallel:
- → rogue-fmg-access
- → rare-config-archive-touches
join: → early-stage-read

## rogue-fmg-access
<!-- Rogue FortiManager registration -->
Detect inbound connections to the management channel from known attacker infrastructure.

```sqlite target=network role=triage params=(attacker_ips_initial=attacker_ips_initial, lookback_days=lookback_days)
~~~yaml
expected: Inbound connections from report IPs to port 541. This signifies a probable
  rogue registration attempt.
reads:
- device_hostname
- src_endpoint_ip
- dst_endpoint_port
- direction
- time
silence: not_evidence_of_absence
source: hb_network_connection
verified: dry-run
verified_at: '2026-10-15'
~~~
SELECT device_hostname, src_endpoint_ip, dst_endpoint_port, direction, time FROM hb_network_connection WHERE dst_endpoint_port = 541 AND instr(',' || '{{attacker_ips_initial}}' || ',', ',' || src_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')
```

## rare-config-archive-touches
<!-- Rare configuration archive touches -->
Stack-count touches to database or archive files used by FortiManager to identify rare exfiltration events.

```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: File touches on archive names restricted to very few hosts. Fleet-wide noise
  would imply standard backups.
prevalence:
  by: device_hostname
  key:
  - file_name
  rare_below: 3
reads:
- file_name
- activity_name
- device_hostname
- time
silence: not_evidence_of_absence
source: hb_file_activity
verified: dry-run
verified_at: '2026-10-15'
~~~
SELECT file_name, activity_name, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_file_activity WHERE (LOWER(file_name) IN ('.tm', 'global.db', 'revinfo.db')) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY file_name, activity_name HAVING hosts < 3
```

## early-stage-read
<!-- Management plane compromise triage -->
```agent target=hunter
cite: required
context:
- vulnerability-scoping
- rogue-fmg-access
- rare-config-archive-touches
max_iterations: 4
objective: Determine if any management hosts show signs of exploitation (CVE-2024-47575)
  and subsequent configuration theft.
success_criteria: A per-host verdict of compromised | suspicious | clean, citing rows
  from network and file surfaces.
tools:
- endpoint
- identity
- network
```

## follow-on-activity
<!-- Corroborate VPN persistence and implant deployment -->
parallel:
- → unauthorized-vpn-logons
- → peerstitch-deployment
join: → full-chain-read

## unauthorized-vpn-logons
<!-- Unauthorized VPN sign-ins -->
Find sign-in events from the report's VPN IPs, filtered by the hosts identified in the scoping phase.

```sqlite target=identity role=enrichment params=(attacker_ips_vpn=attacker_ips_vpn, scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
expected: Authentication events from report-specified IPs to scoped firewalls. This
  confirms the attacker is using stolen credentials.
reads:
- device_hostname
- src_endpoint_ip
- actor_user_name
- status
- time
silence: not_evidence_of_absence
source: hb_auth_signin
verified: dry-run
verified_at: '2026-10-15'
~~~
SELECT device_hostname, src_endpoint_ip, actor_user_name, status, time FROM hb_auth_signin WHERE instr(',' || '{{attacker_ips_vpn}}' || ',', ',' || src_endpoint_ip || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## peerstitch-deployment
<!-- PEERSTITCH deployment artifacts -->
Identify the PEERSTITCH native injector or path-traversal activity on firewall command lines.

```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days)
~~~yaml
expected: Processes running the lldprx binary or command lines executing the setup
  script via traversal. Any such row is a high-fidelity indicator of implantation.
reads:
- device_hostname
- process_name
- process_cmd_line
- time
silence: not_evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-10-15'
~~~
SELECT device_hostname, process_name, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%lldprx' OR (LOWER(process_cmd_line) LIKE '%setup%' AND LOWER(process_cmd_line) LIKE '%../../../../%')) AND time >= datetime('now', '-{{lookback_days}} days')
```

## full-chain-read
<!-- Full chain intrusion triage -->
```agent target=hunter
cite: required
context:
- early-stage-read
- unauthorized-vpn-logons
- peerstitch-deployment
max_iterations: 5
objective: Synthesize the results from early-stage management triage with follow-on
  VPN and deployment evidence to confirm if firewalls have been compromised and implanted.
success_criteria: A forensic summary confirming credential theft, unauthorized access,
  and malware deployment per host.
tools:
- endpoint
- identity
- network
```

## route-on-verdict
<!-- Route on verdict -->
if~: "the forensic triage confirms a chain from management exfiltration to firewall implantation" (confidence: high, judge=hunter)
then: → contain-and-revoke
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: memory-hook-blind-spot)
else: → close-out

## contain-and-revoke
<!-- Isolate firewalls and rotate credentials -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the FortiManager and affected FortiGate appliances. Revoke all credentials contained in the exfiltrated archives (administrative, local, and SSL/VPN passwords).
```
→ analyst-review

## analyst-review
<!-- Verify implant presence -->
```manual target=analyst
Review the full chain triage. Confirm the presence of the lldprx injector. Document which firewalls were touched by the attacker's VPN infrastructure. Document if ptrace or /proc/pid/mem activity was observed.
```
→ close-out

## close-out
<!-- Hunt closure -->
```manual target=analyst
Note the blind spots related to in-memory passive traffic monitoring. Record whether any hosts in scope were missing vulnerability telemetry.
```
→ end