Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
JoinJoin
BREACH WATCH BRIEF Critical 📱 Breach

PEERSTITCH Implant: FortiManager CVE‑2024‑47575 Exploited to Deploy Stealthy ARM64 Malware on Telecom MSP

Unit 42 uncovered a nation‑state‑linked intrusion where attackers leveraged FortiManager CVE‑2024‑47575 and FortiOS CVE‑2025‑61624 to steal configurations of 500+ firewalls and install the memory‑resident PEERSTITCH malware. The breach highlights the need for continuous device‑state monitoring and robust vendor‑risk oversight for audit readiness.

ADTP Breach Watch · October 14, 2026 · Unit42 (Palo Alto)
SeverityCritical
Type📱 Breach
ConfidenceHigh
ReportedOct 14, 2026
Telecommunications Telecommunications service providers Enterprises relying on FortiGate firewalls Vulnerability Exploit

What happened

In September 2024 attackers compromised a FortiManager appliance via CVE‑2024‑47575, harvested configs, keys and databases from over 500 managed FortiGate firewalls, then used CVE‑2025‑61624 to load PEERSTITCH, a file‑less ARM64 implant that hides within legitimate process traffic.

Why it matters for trust and compliance

  • The incident underscores the importance of continuous monitoring of privileged network‑device changes and a disciplined vendor‑risk program to provide defensible evidence for control‑assurance frameworks such as NIST CSF 2.0.
  • Implement continuous monitoring of configuration changes and privileged‑access logs to prove due diligence.
  • Integrate vendor‑risk lifecycle checks to ensure timely patch adoption and audit‑ready evidence.

Who is affected

Telecommunications service providers Enterprises relying on FortiGate firewalls

Recommended actions

  1. Patch FortiManager (CVE‑2024‑47575) and FortiOS (CVE‑2025‑61624) without delay.
  2. Perform forensic analysis of all exported firewall configurations and cryptographic material.
  3. Deploy continuous, immutable logging of device configuration changes and privileged access.
  4. Enforce least‑privilege and MFA for all management accounts.
  5. Add Fortinet advisory monitoring to your third‑party risk program.

Details

CVEs
CVE-2024-47575

Get the Breach Digest

The incidents that matter for your vendors and your data, analysed for practitioners, in one email.