FortiGate Firewalls Suscept to Memory-Malware Hackers exploited vulnerabilities in Fortinet devices to steal sensitive data and deploy a stealthy implant called PEERSTITCH This article explores exploited vulnerabilities fortinet. . Unit 42 discovered the activity while investigating an intrusion against a telecommunications managed service provider that began in September 2024.

Fortinet Firewalls Face Memory-Malware The attack began with CVE-2024-47575, commonly known as FortiJump, in a centralized FortiManager appliance. This vulnerability allows unauthenticated attackers to execute commands through crafted requests to the management channel on TCP port 541. An overview of the intrusion (Source: unit42) This archive contained firewall configurations, management databases, network maps, device serial numbers, encrypted credentials, certificates, and private keys.

The attackers then exploited a path traversal flaw in the FortiOS auto-script engine, a vulnerability that allowed an authenticated administrator to abuse unsanitized script names to read and write files as root, escaping the restricted management interface. Its injector targets two FortiOS services: /bin/miglogd, which handles logging, and /bin/iked, which manages IKE/IPsec VPN negotiations. Indicators of Compromise Type Indicator Description ARM64 PEERSTITCH ELF injector ARM64 memory-allocation shellcode bootstrapper