A single compromised FortiManager appliance was enough to hand attackers control of more than 500 downstream firewalls, according to research by Palo Alto Networks' Unit 42, summarised by Security Affairs. The operation, traced by Unit 42 back to September 2024, revolved around a custom implant the researchers dubbed PEERSTITCH — a lightweight backdoor that kept attackers resident inside a telecom managed service provider's network for months while blending into routine system behaviour.

The pivot: one management console, hundreds of firewalls

FortiManager is Fortinet's centralised management platform, used by service providers and large enterprises to configure fleets of FortiGate firewalls from a single interface. That consolidation is precisely what made it an attractive target: once the appliance was compromised, the attackers were in a position to push configuration changes across roughly 500 managed firewalls — effectively turning a single point of administrative trust into a distribution channel for attacker-controlled policy.

The implication for organisations that delegate firewall management to an MSP, or that run FortiManager themselves, is straightforward. Compromise of the management plane does not stay contained to one device; it propagates to every supervised firewall.

Initial access and the FileZilla C2 channel

According to the researchers' account, initial access came through internet-exposed FortiManager infrastructure. Once inside, the operators deployed PEERSTITCH to establish durable, low-noise access rather than relying on persistent web shells or other obvious backdoors.

One of the more notable tradecraft choices was the command-and-control mechanism. Rather than depend on a bespoke malware protocol, the attackers are reported to have leaned on the FileZilla FTP client — a ubiquitous, business-legitimate tool — to move data and receive tasking. Abuse of FileZilla and similar administrative utilities is a recurring pattern in modern intrusion sets: it defeats naive network alerting, because the traffic resembles ordinary FTP/SFTP activity from software that IT teams expect to see on their networks.

Unit 42's researchers also drew attention to the implant's execution posture. PEERSTITCH was observed running largely in memory within FortiOS, leaving a thin disk footprint and complicating traditional file-based forensics.

Detection: what to look for

The Security Affairs write-up summarises Unit 42's findings rather than reproducing full indicator-of-compromise lists, so teams should anchor detection efforts on behaviour rather than static artefacts. The following hunting leads are relevant to SIEM and EDR workflows:

  • Unexpected FileZilla activity on management servers or security appliances — scheduled or automated FTP transfers from hosts not expected to run the client, particularly those using hard-coded or unusual server endpoints.
  • Anomalous FortiManager administrative activity — configuration pushes, template modifications, or device additions originating outside change windows or from unfamiliar operator accounts.
  • New scheduled tasks, services, or autoruns on FortiManager and FortiOS-adjacent infrastructure appearing shortly after changes to exposed management interfaces.
  • Outbound connections from management-plane hosts to consumer-grade or non-corporate hosting, which frequently indicate relay or staging infrastructure in campaigns of this type.

Security teams running Fortinet estates should cross-reference any behavioural matches against Unit 42's full technical analysis before treating any single detection as confirmation.

What defenders should do now

The remediation steps map directly onto the attack path:

  1. Audit external exposure. Confirm that FortiManager's management interface is not reachable from the public internet. Restrict access to whitelisted administrative networks or VPN paths only.
  2. Review configurations and administrative history. Look for unexpected device entries, template changes, or policy modifications dating back through at least the previous 12 months.
  3. Patch and harden. Ensure FortiManager and managed FortiGate appliances are current with Fortinet's security advisories, and rotate credentials and certificates that were resident on the management appliance.
  4. Hunt memory-resident artefacts. Because the implant favoured in-memory execution, live response and memory analysis will be far more productive than purely file-based scans.
  5. Segment the management plane. Treat FortiManager as a tier-zero asset: isolated network zone, privileged-access controls, enhanced logging, and no direct outbound internet path.

Why it matters beyond one telecom

Fortinet appliances are a fixture across enterprise and service-provider environments in Hong Kong and the wider region, where MSPs routinely manage customer firewall fleets from shared consoles. Campaigns that target the management layer — rather than individual endpoints — scale accordingly, and the FileZilla-based C2 and in-memory execution techniques described by Unit 42 are engineered precisely to survive inside environments where defenders are watching.

Notably, the reporting does not attribute the campaign to a named threat actor, leaving motive — espionage, pre-positioning, or access brokerage — unresolved.

根據 Palo Alto Networks Unit 42 的研究（由 Security Affairs 概述），一部被入侵的 FortiManager 裝置，已足以令攻擊者取得超過 500 部下游防火牆的控制權。Unit 42 追查到該行動最早可追溯至 2024 年 9 月，核心是一款由研究人員命名為 PEERSTITCH 的自訂植入程式——這是一個輕量級後門程式，令攻擊者在一家電訊管理服務提供商（MSP）的網絡內持續駐留數個月，同時融入日常的系統行為之中。

攻擊跳板：一個管理主控台，數百部防火牆

FortiManager 是 Fortinet 的集中管理平台，由服務提供商及大型企業用以從單一界面配置 FortiGate 防火牆機群。正是這種集中化特性，令它成為具吸引力的目標：一旦裝置被入侵，攻擊者便有條件向約 500 部受管理的防火牆推送配置變更——實質上將單一的管理信任點，轉化為散布攻擊者自訂政策的渠道。

對於將防火牆管理外判予 MSP、或自行運行 FortiManager 的機構而言，啟示十分直接：管理面（management plane）一旦失陷，並不會局限於單一裝置，而是會擴散至每一部受其監管的防火牆。

初始入侵途徑及 FileZilla C2 通道

根據研究人員的敘述，初始入侵途徑來自對外開放（internet-exposed）的 FortiManager 基礎設施。進入網絡後，攻擊者部署了 PEERSTITCH，以建立持久、低噪音的存取，而非依賴長期存在的 web shell 或其他明顯的後門程式。

其中一項較為值得注意的技術選擇，是 command-and-control（C2）機制。據報導，攻擊者並沒有依賴專屬的惡意軟件協議，而是借助 FileZilla FTP client——一款普及且在商業上完全正當的工具——來傳輸數據及接收指令。濫用 FileZilla 及類似的管理工具，是現代入侵行動中反覆出現的手法：它可以避開簡單的網絡警報，因為相關流量與 IT 團隊預期會在其網絡上見到的普通 FTP/SFTP 活動無異。

Unit 42 的研究人員亦強調了該植入程式的執行方式。PEERSTITCH 主要在 FortiOS 的記憶體內運行，磁碟上留下的痕跡極少，令傳統以檔案為基礎的取證工作更加困難。

偵測：應留意甚麼

Security Affairs 的文章只是概述 Unit 42 的發現，並未列出完整的 indicator of compromise（IOC）清單，因此團隊應以行為而非靜態 artefacts 作為偵測的依據。以下追查方向與 SIEM 及 EDR 工作流程相關：

  • 管理伺服器或安全裝置上出現異常的 FileZilla 活動——來自不應運行該 client 的主機的排程或自動化 FTP 傳輸，尤其涉及硬編碼或不尋常的 server endpoint。
  • 異常的 FortiManager 管理活動——在變更窗口（change window）以外時間、或來自陌生操作員帳戶的配置推送、模板修改或裝置新增。
  • FortiManager 及 FortiOS 相關基礎設施上新增的排程任務、服務或 autoruns，且出現在對外開放的管理界面變更後不久。
  • 管理面主機向消費級或非企業託管服務發出的 outbound 連線，此類連線往往是這類攻擊行動中的 relay 或 staging 基礎設施。

運行 Fortinet 裝置的防護團隊，在將任何單一偵測視為確認之前，應先將所有行為上的吻合情況與 Unit 42 的完整技術分析交叉比對。

防護者現在應該做甚麼

補救步驟與攻擊路徑直接對應：

  1. 審計對外暴露面。 確認 FortiManager 的管理界面無法從公眾互聯網到達，並只將存取限制於白名單管理網絡或 VPN 路徑。
  2. 覆核配置及管理歷史。 檢查過去至少 12 個月內有沒有預期之外的裝置紀錄、模板變更或政策修改。
  3. 修補及強化防護。 確保 FortiManager 及受管理的 FortiGate 裝置已套用 Fortinet 最新的 security advisory，並更換曾存在於該管理裝置上的憑證及 certificate。
  4. 追查駐留記憶體的 artefacts。 由於該植入程式偏好在記憶體內執行，live response 及記憶體分析的成效會遠高於純粹的檔案掃描。
  5. 分隔管理面。 將 FortiManager 視為 tier-zero 資產：設立隔離的網絡區域、特權存取控制（privileged-access control）、加強記錄，並且不設直接的互聯網 outbound 路徑。

為何此事的重要性超越單一電訊機構

Fortinet 裝置在香港及更廣泛地區的企業及服務提供商環境中隨處可見，而 MSP 往往從共享的主控台日常管理客戶的防火牆機群。針對管理層——而非個別端點——的攻擊行動，其擴展規模同樣成正比，而 Unit 42 所描述的 FileZilla C2 及記憶體內執行技術，正是為了在防護者持續監察的環境內存活而精心設計。

值得注意的是，相關報導並沒有將這次攻擊行動歸因於任何已知的 threat actor，其動機——間諜活動、預先部署（pre-positioning），抑或存取權買賣（access brokerage）——仍未有定論。

新聞來源 / Original News Source