A firewall-management platform is not just another administrative server. It holds relationships that other devices trust. For a small business or government contractor relying on an MSP, recovery planning must account for that shared control plane—not merely the appliance that first raised an alert.

Source: Unit 42’s PEERSTITCH investigation, discovered through Security Affairs reporting in Feedly. Defensive recommendations below are Bulwark Black analysis.

What the investigation established

Unit 42 traced a telecommunications-provider intrusion to FortiManager exploitation through CVE-2024-47575. Stolen material included configurations, credentials and cryptographic assets associated with more than 500 managed firewalls. That is exposure of sensitive management material, not confirmation that every customer network was breached: investigators examined the provider’s environment, not its clients’ networks.

The attackers also exploited the authenticated FortiOS path-traversal vulnerability CVE-2025-61624 and deployed PEERSTITCH. The ARM64 implant modifies running logging and VPN processes, using existing traffic rather than opening its own listening port or initiating outbound connections. Researchers also documented a separate Apache certificate-management command channel and actions suppressing logs. The report does not establish a named nation-state attribution.

Separate three recovery decisions

First, close the entry path. Inventory management appliances and managed firewalls, record firmware versions, and compare them with the vendor’s current advisories. Restrict administrative and device-management paths to explicitly authorized networks. Treat a reachable management service as a deliberate exception that needs an owner and documented justification, not as a convenient default.

Second, establish whether trust material escaped. A successful patch does not invalidate stolen credentials, certificates or keys. If management compromise is suspected, map which devices and tenants trusted the controller, then plan supported rotation and re-enrollment with the vendor or response team. Schedule changes so that replacing one dependency does not strand downstream devices or disrupt essential access.

Third, assess the devices themselves. A clean disk-oriented check cannot by itself rule out a process-memory implant. Preserve available evidence before routine rebooting or rebuilding, while prioritizing containment when active harm is occurring. Have qualified responders select vendor-supported acquisition and recovery methods; do not improvise low-level memory modifications on a production firewall.

What to ask an MSP today

  • Scope: Which controller manages our firewall, and which configuration exports or backups could contain our secrets?
  • Isolation: Can a controller administrator reach multiple customer environments, and what limits that reach?
  • Evidence: Are device registration, configuration changes, administrative access and telemetry gaps recorded outside the management platform?
  • Recovery: Who can rotate device trust and remote-access credentials, and how will completion be demonstrated for our tenant?
  • Notification: What evidence would trigger a customer incident notice, rather than a general assurance that patching is complete?

Make hunting contextual, not just indicator-driven

Review unexpected device enrollments, unauthorized configuration downloads, new administrator objects and unusual auto-script changes. Correlate these events with remote-access activity and gaps in centralized logging. A missing event stream should trigger investigation of collection health and surrounding activity; it is neither proof of compromise nor proof that nothing happened.

Use the primary report’s technical indicators with their stated context. Generic filenames and internal addresses are not reliable standalone verdicts. For a lean team, linking a suspicious management change to a new VPN session or a controller export is usually more actionable than collecting a large blocklist without an investigation process.

Bulwark Black assessment

The operational lesson is to define recovery by restored trust, not installation of a firmware update. Keep a device-to-controller map, a supported secret-rotation procedure and independently retained evidence. For government contractors, preserve the timeline and scope assessment needed to evaluate applicable contractual reporting obligations. Do not equate exposed configurations with confirmed loss of customer data, and do not equate a patched controller with a fully recovered environment.