aiqbench analysis
This report details an active threat where attackers leveraged a FortiManager vulnerability (CVE-2024-47575) to deploy PEERSTITCH malware on managed FortiGate firewalls, enabling stealthy network monitoring and credential theft. The incident highlights critical risks in centralized management architectures, where compromising the controller can lead to widespread exposure of configurations and sensitive data across hundreds of devices without necessarily triggering immediate alerts on the endpoints themselves. Security teams must prioritize patching unauthenticated remote code execution flaws in management planes and rigorously audit configuration backups for signs of tampering or unauthorized packet capture rules.
Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Attackers compromised a telecommunications managed service provider by exploiting vulnerabilities in Fortinet’s centralized management and firewall systems, then deployed PEERSTITCH, a stealthy malware implant that runs inside FortiGate processes. Unit 42 says the activity began with a breach of a FortiManager appliance and exposed configurations and sensitive data linked to more than 500 managed FortiGate […] The post Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls appeared first on Cyber Security News.
Attackers compromised a telecommunications managed service provider by exploiting vulnerabilities in Fortinet’s centralized management and firewall systems, then deployed PEERSTITCH, a stealthy malware implant that runs inside FortiGate processes. Unit 42 says the activity began with a breach of a FortiManager appliance and exposed configurations and sensitive data linked to more than 500 managed FortiGate firewalls. The researchers say this exposure did not confirm that the clients’ firewalls were also compromised. In the September 2024 intrusion, the attackers exploited CVE-2024-47575, also known as FortiJump, against FortiManager. The flaw let an unauthenticated…
Excerpt shown under the publisher's RSS terms · 91 words · full text and figures are on the publisher's site
Related coverage
Top 10 Malware Used by Hackers Last Week to Launch Cyberattacks
Cybersecurity News · Jul 21, 2026
Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware
Cybersecurity News · Sep 8, 2026
Weekly Cyber Security Newsletter Bulletin – Entra ID RCE, Claude Code Ransomware, T-Mobile Cable, Azure Credential Theft +20 Stories
Cybersecurity News · Aug 23, 2026
Hackers Allegedly Selling Fortinet FortiGate 1-Day Vulnerability on Underground Forums
Cybersecurity News · Sep 17, 2026