The increasing reliance on centralized management systems has inadvertently created a single point of failure that sophisticated threat actors are now exploiting with alarming precision and scale. A technical post-mortem of a campaign tracked as CL-STA-0954 recently detailed an advanced multi-stage intrusion that specifically targeted a telecommunications managed service provider. This operation focused on compromising the management platform of the provider to gain unauthorized downstream access to hundreds of edge firewalls, highlighting a shift toward living-off-the-edge techniques. These methods allow attackers to prioritize edge devices and consoles that possess elevated privileges and extensive visibility across entire enterprise networks. By bypassing standard internal security perimeters, the threat actors established a persistent presence that was difficult to detect without deep forensic analysis. This scenario underscores the critical need for robust management-plane security in modern digital ecosystems.
Strategic Access and Network Intelligence Gathering
Technical Analysis: Exploiting the FortiJump Vulnerability
The initial breach was facilitated by a critical vulnerability in the FortiGate to FortiManager protocol, a flaw designated as CVE-2024-47575 and often referred to as FortiJump. This specific vulnerability allowed unauthenticated remote attackers to send specially crafted requests through the management channel to execute unauthorized commands on the target appliance. During the investigation, it was observed that the threat actors exploited this channel to register a rogue device directly to the FortiManager system. This registration was not merely a point of entry but served as a strategic platform for subsequent data exfiltration activities. The attackers utilized their foothold to create a comprehensive archive containing the configuration files for over five hundred managed firewalls. This massive collection of data included device serial numbers, public IP addresses, and routing tables, providing a detailed blueprint of the victim’s entire networking infrastructure.
Beyond the basic network mappings, the stolen configuration archive contained sensitive cryptographic materials and administrative credentials that are vital for secure operations. This included encrypted passwords for administrator accounts, VPN configurations, and cryptographic certificates used to establish trust between the management server and individual edge devices. The acquisition of these materials allowed the threat actors to move beyond simple command execution on a single appliance to a much broader scope of operation. By possessing the keys to the kingdom, they were able to plan their lateral movement with a high degree of confidence and surgical precision. This phase of the attack illustrated how a vulnerability in a management console could be leveraged to compromise an entire distributed network. The volume of intelligence gathered during this stage ensured that the attackers could maintain their progress even if the initial entry point was later identified and patched.
Data Exfiltration: Mapping the Enterprise Infrastructure
Following the successful exfiltration of the configuration archive, the threat actors engaged in a period of technical processing to decrypt and recover administrative and VPN credentials. This transformation of raw data into actionable intelligence allowed them to transition from a centralized compromise to a distributed threat model targeting individual managed firewalls. By utilizing the recovered passwords, the actors established unauthorized VPN sessions that allowed them to bypass traditional perimeter defenses. These sessions granted access to internal management segments that were typically isolated from the public internet. This lateral movement was particularly dangerous because it used legitimate administrative paths, making it nearly indistinguishable from routine maintenance activity. The ability to masquerade as authorized users allowed the attackers to deepen their persistence without triggering standard anomaly alerts or security monitoring systems.
To further solidify their control and gather continuous intelligence, the attackers leveraged the FortiManager platform to push unauthorized packet-capture settings to specific downstream devices. This strategic move enabled the monitoring of unencrypted traffic and sensitive internal services such as TFTP, RADIUS, and LDAP. By intercepting these protocols, the threat actors were able to collect a continuous stream of authentication data, directory activity, and internal file transfers. This passive surveillance provided deep insight into the internal workings of the telecommunications provider, revealing user behaviors and system interdependencies. The use of native management tools to perform malicious activities highlights the inherent risk of compromised administrative consoles. This level of access meant that the attackers did not need to deploy additional malware for reconnaissance, as the existing infrastructure provided all the necessary tools for their mission.
Malware Architecture and System Persistence
Shell Escape: Breaking the Boundaries of FortiOS
The operation entered a significantly more invasive phase with the exploitation of a secondary vulnerability identified as CVE-2025-61624, which involved a path traversal flaw. This vulnerability resided in the FortiOS auto-script feature, which is traditionally used by administrators to schedule and automate routine maintenance tasks. By utilizing the previously recovered administrative credentials, the threat actors were able to bypass the restricted administrative shell and write malicious files directly onto the underlying Linux-based operating system. Because these scripts execute with root-level privileges, the attackers gained total control over the core functions of the firewall devices. This breakout allowed them to deploy a custom ARM64 loader, which served as the primary staging mechanism for the sophisticated PEERSTITCH malware suite. The exploitation of the auto-script feature demonstrated a high level of familiarity with the target operating system’s internal mechanisms.
The deployment of the PEERSTITCH loader was orchestrated through a complex chain of scripts involving Node.js, JavaScript, and WebAssembly components to ensure maximum stealth during execution. This multi-component architecture allowed the malware to operate primarily in system memory, effectively avoiding detection by traditional disk-based security scanners. The loader was specifically designed to inject the core PEERSTITCH implant into critical system processes, ensuring that the malicious code could run with the same privileges as legitimate services. By operating in the volatile memory space, the malware minimized its footprint and reduced the likelihood of forensic discovery during a routine system audit. This move into the underlying operating system layer represented a critical escalation, as the attackers were no longer limited by the constraints of the administrative interface. The transition from configuration abuse to kernel-level exploitation highlighted the maturity of the campaign.
Memory-Resident Stealth: The PEERSTITCH Injection Process
The core of the PEERSTITCH implant was a stealthy ARM64 executable that targeted two vital FortiOS daemons responsible for system logging and VPN management. Specifically, the injector attached to the processes known as miglogd and iked, carving out anonymous memory regions with read, write, and execute permissions. By patching the execution flow of these legitimate daemons, PEERSTITCH was able to intercept and manipulate traffic as it was processed by the firewalls in real time. This allowed the malware to create hidden backchannels and ghost sessions that bypassed standard security checks and protocol validation rules. The implant utilized cross-process memory communication to pass session tags between the logging and VPN components, ensuring that malicious traffic remained invisible to the system monitoring tools. This sophisticated technique turned the firewall security processes against itself, allowing the attackers to maintain a persistent and silent presence.
The investigation into these sophisticated infrastructure intrusions revealed that traditional defensive measures were insufficient against such advanced memory-resident threats. Security teams recognized that the primary challenge lay in the attackers’ ability to repurpose legitimate system modules, such as the Apache certificate management service, for command-and-control persistence. Consequently, organizations implemented more rigorous forensic protocols that included regular memory mapping audits and the immediate rotation of all cryptographic materials following any suspected management breach. These proactive steps were essential for identifying unauthorized 16-kilobyte memory regions and purging the stealthy PEERSTITCH implants from the hijacked daemons. The lessons learned from this campaign emphasized that securing the management plane was just as critical as protecting the data plane. Ultimately, the successful mitigation of these threats depended on a combination of deep technical analysis and a focus on credential hygiene.
