Unnamed Telecommunications MSP Ransomware: FortiGate Implant and PEERSTITCH Deployment (September 2024)

Unnamed Telecommunications Managed Service Provider: What Happened

In September 2024, an unnamed telecommunications managed service provider (MSP) experienced a sophisticated, multi-stage ransomware attack targeting its core infrastructure. Threat actors exploited vulnerabilities in Fortinet’s FortiManager appliance, specifically CVE-2024-47575, to gain initial access. The attackers exfiltrated sensitive configuration files and credential data from over 500 managed FortiGate firewalls, including cryptographic material and administrative credentials. Subsequently, the attackers deployed PEERSTITCH, a stealthy, memory-resident malware implant, leveraging the privilege escalation vulnerability CVE-2025-61624. The breach compromised both the MSP’s internal network and potentially the networks of its downstream clients, with evidence of long-term unauthorized access and the ability to intercept sensitive communications.

Attack Vector & Technical Detail

The intrusion began with exploitation of CVE-2024-47575, a critical vulnerability in FortiManager that allowed remote attackers to bypass authentication controls. Using this vector, the threat actors accessed the central FortiManager appliance and enumerated managed FortiGate devices. Exfiltration of configuration files and credential stores followed, exposing sensitive operational data. The attackers then leveraged CVE-2025-61624, a privilege escalation vulnerability, to deploy the PEERSTITCH malware implant directly into memory, evading traditional disk-based detection. Notably, the attackers utilized rogue infrastructure, including IP addresses 45.32.41.202, 198.199.122.22, 23.240.77.233, and 47.18.167.159, as well as a rogue Virtual FortiGate serial (FMG-VMTM23017412). MITRE ATT&CK tactics observed included Initial Access (TA0001), Collection (TA0009), Defense Evasion (TA0005), and Credential Access (TA0006).

Confirmed Impact

The breach resulted in the exposure of critical configuration files, cryptographic keys, and administrative credentials for over 500 managed FortiGate firewalls. This allowed attackers to establish persistent access, intercept VPN sessions, and potentially deploy additional backdoors across client environments. The compromise extended beyond the MSP’s internal infrastructure, raising the risk of secondary breaches among its global client base. Regulatory implications are significant, given the exposure of sensitive communications and potential violation of data protection standards in multiple jurisdictions. The attackers’ ability to evade detection and maintain long-term access underscores the severity of the incident.

What This Means for Your Organization

This incident highlights the critical risk posed by vulnerabilities in centralized management appliances such as FortiManager, especially for organizations managing large-scale, multi-tenant environments. Attackers are increasingly targeting privileged infrastructure to gain access to downstream assets and sensitive data. Organizations should prioritize patching known vulnerabilities (such as CVE-2024-47575 and CVE-2025-61624), enforce strict access controls, and monitor for anomalous activity on management interfaces. Regular review of firewall configurations and credential hygiene is essential to mitigate the risk of lateral movement and long-term persistence.

Detection & Response

• Immediate: Isolate affected FortiManager and FortiGate appliances from the network and initiate a forensic review of configuration and credential stores.
• Hunt: Search for connections to the following IOCs: 45.32.41.202, 198.199.122.22, 23.240.77.233, 47.18.167.159, and the rogue Virtual FortiGate serial FMG-VMTM23017412.
• Patch: Apply vendor-released patches for CVE-2024-47575 and CVE-2025-61624 to all FortiManager and FortiGate devices.

Source: https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/