PEERSTITCH implant tags FortiOS VPN sessions to skip security checks
Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with CVE-2025-61624, which CISA added to KEV on October 16, and stole VPN credentials from 500+ firewalls.
Unit 42 at Palo Alto Networks published research on October 14 about PEERSTITCH, a memory-resident FortiOS implant found during an intrusion at a telecommunications provider that began in September 2024. The actor, tracked as CL-STA-0954 or UNC5820, got in through the FortiManager flaw CVE-2024-47575, then used CVE-2025-61624, a CLI path traversal letting a read-write administrator write files as root, to plant the implant. PEERSTITCH attaches to the miglogd and iked daemons; when iked sees a VPN session carrying its tag, it takes a branch that skips default FortiOS security validations. CISA added CVE-2025-61624 (Fortinet CVSS 6.0) to its KEV catalog on October 16, due October 19. FortiOS 7.6.5 and 7.4.10 fix it; 7.2, 7.0 and 6.4 need migration.
Why it matters
An implant inside the IKE daemon decides which VPN sessions get checked, so authentication logs on the firewall stop being evidence of who connected. The data theft matters more: running configurations for over 500 managed FortiGates, administrative, local and SSL VPN credentials stored as reversible ciphertext that the attackers recovered, and certificates with private keys.
Unit 42's advice is to treat the credentials and certificates these devices hold as compromised. That means rotating VPN user passwords and admin accounts, reissuing VPN and admin certificates, and moving remote access to phishing-resistant MFA so a recovered password is not enough. It is the same lesson as FortiBleed: firewall admin access is a credential store.
Source: The Hacker News
Related on Start with Identity
- BlogQilin and INC use the GlobalProtect auth bypass to skip MFA, then dump domain controller disks
Unit 42's October 19 update says Qilin and INC ransomware operators are exploiting CVE-2026-0257 in PAN-OS GlobalProtect to open VPN sessions without MFA, then
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,
- CVECheck Point Security Gateway information disclosure of password hashes
An unauthenticated read on Check Point Security Gateways leaked password hashes, including those used for VPN and local admin. CISA KEV. May 2024. Hash disclosu