PEERSTITCH Implant: FortiManager CVE‑2024‑47575 Exploited to Deploy Stealthy ARM64 Malware on Telecom MSP
What It Is – In September 2024 a nation‑state‑linked group leveraged CVE‑2024‑47575 in FortiManager to gain initial foothold on a telecommunications managed‑service provider. The attackers later used CVE‑2025‑61624 (FortiOS auto‑script path traversal) to load PEERSTITCH, a memory‑resident ARM64 implant that evades traditional endpoint and network detection.
Exploitability – Both CVEs are publicly disclosed, have published patches, and have been observed in the wild. CVE‑2024‑47575 carries a CVSS v3.1 base score of 9.8 (Critical). Active exploitation was confirmed by Palo Alto Networks Unit 42.
Affected Products – FortiManager (centralized management appliance) and FortiOS on FortiGate firewalls (ARM64 platforms).
Why It Matters for Trust & Control Assurance
- Continuous configuration monitoring – The breach stemmed from unpatched management infrastructure; ongoing evidence of device‑state and change logs is essential to demonstrate due diligence.
- Vendor oversight – Reliance on a single network‑security vendor without verified patch‑management processes creates a blind spot across multiple customer environments.
- Defensible audit trail – Capturing immutable logs of privileged access and firmware updates provides the audit evidence demanded by enterprise buyers and regulators (e.g., NIST CSF 2.0).
Recommended Actions
- Apply FortiManager and FortiOS patches for CVE‑2024‑47575 and CVE‑2025‑61624 immediately.
- Conduct a forensic review of all managed FortiGate configurations, cryptographic material, and database exports for signs of tampering.
- Deploy continuous monitoring of configuration changes and privileged‑access events on all network devices.
- Reinforce least‑privilege policies for management accounts and enforce MFA.
- Integrate the vendor‑risk lifecycle into your control‑assurance program to ensure timely visibility of future Fortinet advisories.
Source: Palo Alto Networks Unit 42 – PEERSTITCH Investigation