Hackers used a Fortinet firewall flaw to steal secrets on 500-plus networks
A path traversal bug in FortiOS, now tracked as CVE-2025-61624, let attackers plant memory-only malware and ride stolen VPN sessions into a telecom's clients.
Key points - Investigators at Palo Alto Networks say attackers used a FortiManager flaw to steal configurations for more than 500 managed FortiGate firewalls belonging to one telecom and its customers. - The same group then abused CVE-2025-61624, a path traversal flaw in Fortinet's command line, to drop a new memory-only malware called PEERSTITCH on ARM64 firewalls. - Fortinet's advisory lists fixed builds for FortiOS, FortiProxy, FortiPAM and FortiSwitchManager; anything running older FortiOS branches needs a migration, not a patch. - The intrusion dates to September 2024 and is linked to a group with tradecraft that overlaps suspected nation-state activity. - Attackers used stolen credentials and keys to open VPN sessions that looked legitimate, defeating normal checks on who was logging in.
A suspected state-linked crew spent months inside a telecommunications company by chaining two Fortinet bugs, and the second one is only now getting a public fix.
Palo Alto Networks' Unit 42 published the full story this week. What matters for anyone running Fortinet gear is the pattern, not the malware's name. We covered a separate Fortinet device-takeover campaign in our 17 September story, which found more than 178 machines already infected; this incident is older and larger.
What actually happened?
In September 2024 the attackers broke into a central FortiManager appliance, the box a company uses to configure all of its Fortinet firewalls from one place. From it they pulled running configs, cryptographic keys and database files covering more than 500 FortiGate firewalls.
Those firewalls protected the telecom itself and its clients. Owning the manager meant owning everyone downstream.
With the stolen keys and configs, the group maintained long-term access, intercepted traffic, opened their own VPN sessions and planted backdoors. They later used a second Fortinet bug to climb to higher privileges.
What is CVE-2025-61624 and why does it matter?
It's a path traversal flaw in the command line of FortiOS, FortiProxy, FortiPAM and FortiSwitchManager. An admin-level user can feed crafted arguments to normal CLI commands and write or delete files anywhere on the device, not just where they're supposed to.
NVD scores it 5.4, medium severity, because an attacker already needs admin credentials to use it. The catch is that this group already had those credentials, lifted from the FortiManager archive. A medium-severity bug behaves like a critical one when the attacker's holding your admin password.
Unit 42 says the attackers used the flaw through FortiOS auto-scripts to drop PEERSTITCH, a piece of malware that runs only in memory on ARM64 firewalls. Memory-only means no file on disk for a scanner to find, and a reboot wipes it, which also wipes the evidence.
Which versions are fixed?
Fortinet's advisory lists the fixed builds.
| Product | Affected | Fixed in |
|---|---|---|
| FortiPAM 1.7 | 1.7.0 | 1.7.1 |
FortiPAM 1.8 is not affected.
Should ordinary customers worry?
Not directly. Their phone or internet provider might be carrying the risk on their behalf. If your telecom used this victim's managed security service, your traffic was crossing devices whose keys sat in a stolen archive. End users can't patch vendor infrastructure; the practical response is to treat SMS codes as weak, use app-based logins and watch bank and email accounts for unusual sign-ins.
The failure mode here is familiar to anyone who's written a postmortem: one central management box, one unpatched flaw, and the blast radius covers every downstream device it ever touched. Rotating the keys and certificates on those 500 firewalls should've started the day FortiManager was found compromised.
Patch the CLI bug. Then treat everything FortiManager ever held as burned.
