The old bug isn’t the news here. FortiJump was patched and added to CISA’s KEV catalog back in 2024. The news is what a patient actor did with one management box once it had it, and how long that access kept paying out. Unit 42 says parts of the post-exploitation tradecraft overlap with intrusions attributed to suspected nation-state actors. It doesn’t name a country, and neither will we.
What left the building. From the single FortiManager, the attackers took the appliance’s management relationships, running configs for more than 500 FortiGates, the central SQLite databases, an inventory of FortiGate serials with public IPs, topology and routing data, admin and SSL VPN credentials stored as reversible ciphertext, and certificates and private keys. Unit 42 confirmed those credentials were recoverable by brute-forcing them from the stolen configs. Its investigation covered the MSP’s own environment, not the client networks, so what’s confirmed for clients is exposure of config and credential material, not intrusion.
How they came back. After a long dwell, the actor pushed unauthorized packet-sniffer configs from FortiManager to downstream FortiGates to capture cleartext HTTP and 11 other services, logged in over SSL VPN with recovered credentials, and impersonated FortiManager to pull from managed firewalls. To get from FortiOS admin to root, it abused CVE-2025-61624, a path traversal in the FortiOS CLI auto-script engine. A script name like ../../../../setup lands the script body anywhere on the filesystem and runs it as root. The Hacker News reports Fortinet patched that flaw in April 2026.
Why PEERSTITCH is nasty. It ptrace-injects hooks into two FortiOS daemons, miglogd and iked, leaves no binary on disk, opens no listening port and makes no outbound connection. The logging-daemon hook watches traffic for a marker (port value 8550, link-local address 169.254.0.1) and passes a session token to the VPN daemon, which then skips normal FortiOS security checks for tagged VPN sessions. Separately, the actor turned FortiGate’s Apache mod_md ACME module into an SSH reverse shell via a rogue ACME config. It also killed syslog, cleared crash logs and auto-deleted its rogue admins and auto-scripts.
What we’d do this week. If you run FortiManager, or an MSP runs it for you, ask the direct question: was it internet-reachable on TCP 541 before the FortiJump patch? If yes, patching wasn’t the end of it. Rotate every admin, local and SSL VPN credential and every certificate and private key that FortiManager held for managed devices, because Unit 42’s point is that trust material stays valid until you rotate it. Then hunt: auto-script objects with ../ in the name, md-acme.conf under /tmp/apache2/conf, sniffer profiles you didn’t create, VPN logins from 23.240.77.233 or 47.18.167.159, rogue FortiManager registrations (Unit 42 saw a fake virtual FortiGate named localhost), and syslog gaps. Get CVE-2025-61624 patched on FortiOS, FortiProxy, FortiPAM and FortiSwitchManager. Unit 42 published SHA-256 hashes for the PEERSTITCH components.