FortiManager breach yields 500 FortiGate configs enabling CVE-2025-61624 zero-day use for PEERSTITCH injection

Initial access came from exploitation of FortiJump (CVE-2024-47575) against a telecom MSP's FortiManager. The resulting archive contained running configs, private keys, and serial-to-IP mappings for over 500 managed FortiGate devices. Attackers established unauthorized VPN sessions and escalated via the April 2026-patched path traversal to deploy memory-resident PEERSTITCH without disk artifacts or new sockets. Unit 42 telemetry shows the injector (lldprx) uses ptrace to patch the two daemons, creating an in-memory bridge that tags traffic on port 8550 and reuses legitimate miglogd/iked flows. This matches patterns seen in prior Fortinet supply-chain compromises where configuration exfiltration preceded lateral movement across client perimeters. The timeline reveals inconsistency: activity predates public patch by 18 months, indicating sustained zero-day access rather than post-disclosure exploitation. Managed service providers remain high-value targets because one FortiManager compromise yields reusable credentials across hundreds of customer edges. Next observable indicators will likely be similar process-memory hooks on FortiOS 7.x devices still running unrotated keys from the original FortiManager dump; operators should audit FortiManager backup integrity and enforce serial-based allowlisting on VPN interfaces.