- Unit 42 reports attackers breached a telecom provider's FortiManager via CVE-2024-47575 and took configurations and credentials for more than 500 managed firewalls.
- The attackers also used CVE-2025-61624 to install PEERSTITCH, a memory-only implant. Patching does not invalidate the stolen keys and passwords.
- Leaders should list every platform holding downstream credentials and plan a full rotation of passwords, certificates and keys if one is breached.
The master key outlives the broken lock
A building manager's master key opens every door. If a thief copies it, a new front lock does not help. The copy still opens the other doors. Unit 42, the research team at Palo Alto Networks, describes a digital version of this problem. The lesson here is that patching closes the way in. Only changing credentials takes the keys back.
Unit 42 investigated an intrusion at a telecom managed service provider in September 2024. It tracks the attackers as CL-STA-0954, also called UNC5820. They broke in through CVE-2024-47575 on the provider's FortiManager. That is the central console for managing Fortinet FortiGate firewalls.
What one appliance gave away
CVE-2024-47575 lets an attacker with no login run commands. The attacker sends crafted requests to the management channel on TCP port 541. The attackers registered a fake virtual firewall to the console. Then they built an archive and took it out.
Unit 42 says the archive held full configurations for more than 500 managed FortiGate firewalls. Those firewalls protected the provider and its clients. The archive also held network maps, routing tables, management databases, private keys and certificates.
Passwords were stored in a form that can be reversed. Unit 42 proved this by cracking administrator and SSL/VPN passwords from the stolen files.
One limit matters. Unit 42 studied only the provider's own environment. It did not examine the client networks. The report describes exposed configuration and credentials. It does not describe confirmed break-ins at clients.
How the intrusion worked
The attackers waited a long time. Then they used the console to send packet-capture settings to several managed firewalls. Packet capture copies network traffic as it passes through. It targeted unencrypted web traffic and 11 specific services. These included file transfer, RADIUS network logins and LDAP directory queries.
Later, the attackers used valid credentials to open SSL/VPN sessions. These gave them access to internal management networks.
During the intrusion, they also exploited CVE-2025-61624. A FortiOS administrator works in a locked-down command line with no shell. The system's own programs run as root underneath. The flaw is in the auto-script feature, which does not clean script names. A name with path-traversal sequences can place a script anywhere on the file system. The attackers used this to gain root access.
Root access let them install PEERSTITCH, a new ARM64 implant that lives only in memory. It patches two FortiOS programs, miglogd and iked. It builds a hidden link between them.
Security tools usually look for a file, an open port or a call to a strange server. PEERSTITCH gives them none of those. It hides inside traffic that trusted processes already produce.
The attackers also built a second control channel from a normal Apache feature. It is the module that renews certificates using the ACME protocol. They pointed it at their own server. They mapped a validation step to the Node.js program. Commands hidden in a domain name then started an SSH reverse shell. That is a connection the attacker uses to control the device remotely.
Unit 42 also saw an account named FortiGateCloud download configurations from several firewalls. The victim had no FortiManager Cloud tenant. Unit 42 assesses with medium confidence that the attackers posed as the management platform. The evidence does not show which of two possible paths they used.
Why this is hard to catch
Unit 42 says detection needs specialized hunting techniques. Its report documents them. The attackers also took steps to erase forensic traces.
Unit 42's main point is about trust. The console holds trust records for every device it manages. Those records left with the attacker. They stay valid until someone replaces them. A patched console can still hand out working access.
Unit 42 advises treating those credentials and certificates as compromised the moment the platform is.
What to ask your team
First, ask which management platforms hold credentials, private keys or configurations for other devices. That list is your set of master keys. Second, ask whether a breach of one would trigger a full rotation of passwords, certificates and keys downstream. Ask who owns that task.
Third, ask whether management interfaces such as TCP port 541 are reachable from the internet. Fourth, ask whether your team can hunt for memory-resident implants. Providers that manage firewalls for clients should ask what they would tell those clients after such a breach.
A patch fixes the door. The keys that were copied stay valid until you change them.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Palo Alto Networks Unit 42.
