The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added vulnerabilities affecting multiple Fortinet products and BeyondTrust Remote Support to its Known Exploited Vulnerabilities (KEV) catalog. A KEV listing is not a theoretical warning — it is CISA's confirmation that threat actors are exploiting these flaws in the wild, and that federal civilian executive branch agencies must remediate within the mandated Binding Operational Directive 22-01 window (typically three weeks from listing). Every private-sector organization running these products should treat that deadline as their own.
The timing is not coincidental. Palo Alto Networks researchers this week reported that the PEERSTITCH malware family is abusing FortiManager — Fortinet's centralized management platform — in a campaign that has already exposed configuration data and access to more than 500 managed firewalls. When your management plane is compromised, the blast radius is every device it manages. Combined with BeyondTrust Remote Support — a privileged remote access tool that, by design, has deep reach into endpoints — these KEV entries represent management-plane and privileged-access compromise scenarios that defenders cannot afford to deprioritize.
This post breaks down the threat, gives you detection logic you can deploy today, and lays out a concrete remediation path.
Technical Analysis
Affected Products
- Fortinet multiple products — The KEV entry covers a vulnerability spanning Fortinet's product line, including FortiOS, FortiManager, FortiProxy, and related platforms. FortiManager is the component of greatest concern in the current campaign, as it holds credentials, policies, and configuration for every managed FortiGate in the environment.
- BeyondTrust Remote Support — A vulnerability in the Remote Support product enabling attackers to execute commands on affected systems. Remote Support appliances and jump clients are privileged by design: they initiate remote sessions, often with elevated rights, into endpoints across the enterprise.
How the Attacks Work — Defender's Perspective
FortiManager / PEERSTITCH campaign: Attackers target the FortiManager appliance's management interfaces and its communication with managed FortiGate devices (the fgfmsd daemon handling FortiGate-to-FortiManager communication on TCP/541). Successful exploitation gives the attacker a foothold on the management appliance, from which they deploy the PEERSTITCH malware to harvest device configurations, credentials, and network topology data. Palo Alto Networks reports over 500 firewalls exposed — meaning stolen configuration files containing interface definitions, VPN parameters, admin accounts, and potentially pre-shared keys. From a defender's view, the observable chain is: anomalous inbound connection to FortiManager management ports → anomalous process execution or file writes on the appliance → bulk configuration retrieval from managed FortiGates → outbound staging/exfiltration of config archives.
BeyondTrust Remote Support: Exploitation of the flaw enables command execution in the context of the Remote Support service. Observable behavior includes the BeyondTrust service processes (bomgar-scc, bomgar, or related jump client executables) spawning unexpected child processes such as cmd.exe, powershell.exe, sh, or scripting engines — a classic signal that a remote access tool is being abused as a living-off-the-land execution vehicle.
Exploitation Status
- Both vulnerabilities are in the CISA KEV catalog — meaning confirmed, active exploitation in the wild. This is not PoC-stage or theoretical.
- The PEERSTITCH campaign is ongoing, with Palo Alto Networks documenting 500+ compromised/exposed firewalls via FortiManager abuse.
- Federal agencies are under a mandatory remediation deadline under BOD 22-01. Assume nation-state and criminal operators are scanning for unpatched instances continuously; KEV listings historically correlate with a measurable spike in opportunistic exploitation within 72 hours of publication.
Detection & Response
The detections below focus on the two highest-fidelity behaviors: (1) anomalous process execution and file activity originating from FortiManager and its daemons, and (2) BeyondTrust Remote Support processes spawning shells or scripting engines. Tune for your environment, but these should not fire on legitimate day-to-day administration.
Sigma Rules
---
title: BeyondTrust Remote Support Spawning Shell or Scripting Engine
id: 9c4e2b71-3f6a-4d28-b1c5-8a7f0e2d6b93
status: experimental
description: Detects BeyondTrust Remote Support service or jump client processes spawning command shells or scripting engines, consistent with post-exploitation command execution via the KEV-listed Remote Support vulnerability.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\bomgar-scc.exe'
- '\bomgar.exe'
- '\srd.exe'
- '\representative_console.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
condition: selection_parent and selection_child
falsepositives:
- BeyondTrust support sessions where an engineer legitimately opens a command shell on the endpoint; correlate with open BeyondTrust session logs before escalating
level: high
---
title: Shell Execution via FortiManager-Managed Linux Appliance Components
id: 2f8a1d64-7c3b-4e95-a6f2-1b9c4d8e5a07
status: experimental
description: Detects shells or scripting interpreters spawned by FortiManager daemons or appliance services on Fortinet management infrastructure, consistent with exploitation of FortiManager and PEERSTITCH staging activity.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- 'fgfmsd'
- 'fmgsvrd'
- 'fmgd'
- 'httpd'
- 'nginx'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/python'
- '/python3'
- '/perl'
- '/curl'
- '/wget'
condition: selection_parent and selection_child
falsepositives:
- Rare Fortinet support diagnostics run under TAC guidance
level: high
---
title: Bulk FortiGate Configuration Retrieval via FortiManager
id: 6b1e3a92-5d47-4f18-c9a3-3e7d2f6b8c41
status: experimental
description: Detects archive and exfiltration tooling executed on Fortinet management infrastructure, consistent with PEERSTITCH harvesting firewall configuration files from managed devices.
references:
- https://attack.mitre.org/techniques/T1560.001/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/01/15
tags:
- attack.collection
- attack.exfiltration
- attack.t1560.001
logsource:
category: process_creation
product: linux
detection:
selection_host:
Hostname|contains:
- 'fmg'
- 'fortimanager'
- 'faz'
- 'fortianalyzer'
selection_tools:
CommandLine|contains:
- 'tar czf'
- 'tar -czf'
- 'zip -r'
- 'base64'
- 'curl -F'
- 'curl --upload-file'
- 'wget --post-file'
- '/diag sys'
- 'show full-configuration'
condition: all of selection_*
falsepositives:
- Scheduled backup scripts on FortiManager; baseline authorized backup jobs and exclude their service accounts
level: medium
KQL Hunt — Microsoft Sentinel / Defender
This query hunts across Syslog/CommonSecurityLog (Fortinet appliances ingested via CEF/Syslog) and Defender endpoint telemetry for BeyondTrust process abuse and anomalous FortiManager activity in the last 14 days.
let lookback = 14d;
// Hunt 1: BeyondTrust Remote Support spawning shells or scripting engines
let BTAbuse = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName has_any ("bomgar-scc.exe", "bomgar.exe", "srd.exe")
| where FileName has_any ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe")
| project BTTime=TimeGenerated, BTDevice=DeviceName, BTParent=InitiatingProcessFileName, BTChild=FileName, BTCmdLine=ProcessCommandLine, BTAccount=AccountName;
// Hunt 2: FortiManager syslog - admin logins from new sources and config retrieval bursts
let FMGEvents = union isfuzzy=true Syslog, CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where Computer has_any ("fmg", "fortimanager") or DeviceVendor =~ "Fortinet"
| where Message has_any ("login", "config", "backup", "download", "retrieve")
| extend SrcIP = tostring(column_ifexists("SourceIP", column_ifexists("SourceIP_s", "")))
| project FMGTime=TimeGenerated, FMGHost=Computer, SrcIP, Message, Severity=column_ifexists("LogSeverity", "");
BTAbuse;
FMGEvents
| summarize LoginAttempts=count(), DistinctSources=dcount(SrcIP) by FMGHost, SrcIP, bin(FMGTime, 1h)
| where DistinctSources > 3 or LoginAttempts > 50
| sort by FMGTime desc
Run the BeyondTrust portion first — any hit there is an immediate escalation given the KEV status. For the FortiManager hunt, focus on administrative logins sourced from IPs outside your known management subnets and any configuration-download bursts from accounts that don't match your automation service accounts.
Velociraptor VQL Hunt
Use this on Windows endpoints where BeyondTrust jump clients or representative consoles are installed, to surface BeyondTrust-spawned command execution across the fleet.
-- Hunt BeyondTrust Remote Support processes spawning shells or script engines
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
pslist(Pid=Ppid)[0].Name AS ParentName,
pslist(Pid=Ppid)[0].Exe AS ParentExe
FROM pslist()
WHERE ParentExe =~ '(?i)bomgar|srd\.exe'
AND Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32)\.exe'
Remediation
Immediate Actions (24–48 hours)
- Patch per vendor advisories — now. Apply the fixed releases published in the Fortinet PSIRT advisory covering the KEV-listed flaw across FortiOS, FortiManager, FortiProxy, and other affected products, and the BeyondTrust security advisory for Remote Support (self-hosted customers must apply the update to their appliances; cloud instances are patched by the vendor — verify with BeyondTrust support). Do not assume cloud-hosted means covered; confirm in writing.
- Isolate the management plane. FortiManager should never be reachable from the internet or from general user VLANs. Restrict access to the management interfaces and the FortiGate-to-FortiManager communication channel (TCP/541) to known management subnets and managed device IPs only. If your FortiManager is internet-exposed today, treat it as potentially compromised.
- Hunt before you patch. Patching does not evict an attacker. Run the detections above, review FortiManager administrative login history for unrecognized source IPs, and audit BeyondTrust session logs for sessions initiated outside normal support workflows.
- Rotate credentials on assumption of exposure. If your FortiManager holds FortiGate admin credentials, VPN pre-shared keys, or RADIUS/LDAP bind accounts — and the PEERSTITCH campaign demonstrates it does — rotate them. The 500+ exposed firewalls in the current campaign had exactly this data harvested.
Configuration Hardening
#!/bin/bash
# FortiManager / FortiGate post-KEV hardening and audit script
# Run via FortiManager CLI session or against FortiGate via SSH
# 1. Verify firmware/patch level against the Fortinet PSIRT advisory
# (compare output to the fixed-version table in the advisory)
echo "=== Current FortiManager/FortiOS version ==="
get system status | grep -i version
# 2. Audit administrative access - restrict trusted hosts on admin accounts
echo "=== Admin trusted hosts audit (should be management subnets only) ==="
show system admin | grep -A5 "trusthost"
# 3. Verify fgfmsd (FortiGate-FortiManager) access is restricted
# Confirm only authorized FortiGates can connect on TCP/541
echo "=== FGFM connections - review for unknown peers ==="
diagnose fgfmsd status
diagnose sniffer packet any 'tcp port 541' 4 0 a
# 4. Review recent admin logins for anomalous source IPs
echo "=== Recent admin login events ==="
execute log filter category event
execute log filter field subtype system
execute log display | grep -i "login"
# 5. Check for unauthorized config retrieval / backup jobs
echo "=== Recent config and backup activity ==="
diagnose dvm task list
execute log display | grep -iE "backup|retrieve|download"
# 6. Disable any unused management protocols on the appliance
echo "=== Interface service exposure ==="
show system interface | grep -E "allowaccess"
# Remove: ping telnet http https snmp fgfm from any non-management interface
# BeyondTrust Remote Support post-KEV verification script (Windows jump hosts / endpoints)
# 1. Inventory BeyondTrust components and versions across the estate
Get-WmiObject Win32_Product -ErrorAction SilentlyContinue |
Where-Object { $_.Name -match 'BeyondTrust|Bomgar' } |
Select-Object Name, Version, InstallDate | Format-Table -AutoSize
# 2. Confirm appliance/client version against the BeyondTrust security advisory
# Any version below the fixed release in the advisory = escalate to patching
# 3. Hunt for BeyondTrust processes spawning shells in the last 14 days
$lookback = (Get-Date).AddDays(-14)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$lookback} -ErrorAction SilentlyContinue |
Where-Object { $_.Message -match 'bomgar|srd\.exe' -and
$_.Message -match 'cmd\.exe|powershell\.exe|wscript\.exe|mshta\.exe' } |
Select-Object TimeCreated, Message | Format-List
# 4. Audit active BeyondTrust-initiated sessions and outbound connections
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
Where-Object { (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name -match 'bomgar|srd' } |
Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess
Strategic Recommendations
- Adopt the CISA KEV as your de facto SLA. If your vulnerability management program still triages by CVSS alone, you will lose this race every time. KEV-listed CVEs should trigger an emergency change window regardless of score.
- Monitor your management plane like a crown jewel. FortiManager, BeyondTrust, SCCM, and similar platforms are force multipliers for attackers. They deserve dedicated detections, segmented access, and MFA on every administrative path.
- Subscribe to the Fortinet PSIRT and BeyondTrust security advisory feeds and reconcile them against your asset inventory within 24 hours of publication. If you can't enumerate every FortiManager and BeyondTrust instance in your environment in under an hour, fix that first.
- Assume configuration theft in any management-plane compromise. Stolen FortiGate configs enable offline password attacks, VPN pre-shared key recovery, and precise network mapping. Your incident response plan must include credential rotation and firewall rule review, not just reimaging the appliance.
The combination of a KEV listing and an active, documented campaign like PEERSTITCH is the clearest signal a defender gets. Patch, hunt, rotate — in that order, starting today.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.