What Happened
Palo Alto Networks Unit 42 found PEERSTITCH while investigating a prolonged intrusion at a telecommunications managed service provider. The Hacker News reports the actor, tracked as CL-STA-0954, entered through the FortiManager flaw FortiJump, CVE-2024-47575, in September 2024.
The malware leaves no binary on disk. It downloads components, injects code into the FortiOS daemons miglogd and iked through ptrace, and builds a memory channel between them. Traffic tagged with marker values then skips default VPN session checks. The delivery path used CVE-2025-61624, a CVSS 5.4 path traversal in the FortiOS command line, which Fortinet patched in April 2026. The actor took configuration data, certificates, and encrypted credentials for more than 500 managed FortiGate firewalls. It stopped syslog and cleared crash logs.
Why This Matters for Canadian Organizations
The report names no Canadian victims. Fortinet firewalls guard many Canadian enterprises, municipalities, and service providers, and managed providers hold the keys to many customers at once. Telecommunications sits within the critical infrastructure sectors the Canadian Centre for Cyber Security tracks.
A medium CVSS score hides the real risk. The flaw needs a privileged foothold, and attackers already held one. Teams which rank patches by score alone leave this class of bug open for months. Financial firms under OSFI B-13 and holders of personal data under PIPEDA need to treat firewall integrity as a reportable concern.
What to Do
Apply Fortinet advisory FG-IR-26-122 and confirm FortiManager is patched against FortiJump. Block 23.240.77[.]233 on port 8085. Check for the file names pM.js, a.wasm, and lldprx. Rotate certificates, keys, and VPN credentials on any managed firewall exposed to a compromised manager. Send firewall logs off-device, because the actor erased local ones. Read more in our TechTalk coverage.
