HighAPTCVE-2024-47575
Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Cyber Security News·Source published ·1 min read
What happened?
Attackers compromised a telecommunications managed service provider by exploiting vulnerabilities in Fortinet’s centralized management and firewall systems, then deployed PEERSTITCH, a stealthy malware implant that runs inside FortiGate processes. Unit 42 says the activity began with a breach of a FortiManager appliance and exposed configurations and sensitive data linked to more than 500 managed FortiGate firewalls. The researchers say this exposure did not confirm that the clients’ firewalls were also compromised.
Key details
- Attackers breached a telecom managed service provider by exploiting FortiManager and FortiGate vulnerabilities.
- The intrusion began with CVE-2024-47575 exploitation against FortiManager, exposing data from over 500 managed FortiGate firewalls.
- Stolen archive contained firewall configurations, credentials, certificates, and trust material enabling further compromise.
- Attackers used recovered credentials to open unauthorized VPN sessions and access internal network management areas.
Affected
- FortiManager appliances vulnerable to CVE-2024-47575 (FortiJump).
- More than 500 managed FortiGate firewalls had configurations and sensitive data exposed.
Fixes and mitigations
- Review FortiManager and FortiGate records for unexpected device registrations, unfamiliar admin accounts, suspicious VPN sessions, and auto-script entries with path traversal strings.
- Compare firewall configurations with known-good backups and treat credentials, certificates, and trust material from compromised management server as exposed.
- Examine memory maps of miglogd and iked for anonymous 16-kilobyte RWX regions and check for memory patches at specific offsets.
What to look for
- File paths: lldprx, pM.js, index.js, index.wasm, ipssem.js, ../../../../setup, ../../tmp/apache2/conf/md-acme.conf.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.