PEERSTITCH Malware Weaponizes Fortinet Ecosystem to Compromise Hundreds of Firewalls
Attackers leverage FortiManager and memory injection to silently hijack enterprise network perimeters.
1Central Management Breach
Palo Alto Networks Unit 42 uncovered a multi-stage intrusion from September 2024 tracked as CL-STA-0954 or UNC5820. Threat actors breached a telecommunications managed service provider via FortiManager vulnerability CVE-2024-47575, termed FortiJump. This single point of failure exposed configurations and cryptographic material covering more than 500 downstream firewalls.
2Rogue Registration Exploitation
Attackers exploited CVE-2024-47575 over TCP port 541 to register an unauthenticated virtual device on the central FortiManager appliance. Within minutes, they extracted archives containing public IP addresses, routing tables, and cryptographic trust material. Reversible password ciphertext allowed threat actors to establish unauthorized SSL/VPN sessions directly into internal management segments.
3Privilege Escalation via Auto-Scripts
After gaining access, the attackers leveraged CVE-2025-61624, a path traversal flaw in the FortiOS auto-script CLI engine. This vulnerability allowed arbitrary file manipulation to deploy a sophisticated toolchain. The payload delivered PEERSTITCH, an unrecorded 64-bit ARM64 binary written in C, downloaded alongside five modular staging components.
4Volatile Memory Operation
PEERSTITCH executes entirely in volatile memory, writing no persistent binaries to disk and opening no listening ports. It initiates no outbound network connections, rendering standard endpoint detection ineffective. Fortinet's Integrity Checker Tool fails to detect the implant because it validates only on-disk files, which remain completely unmodified.
5Dual-Daemon Memory Injection
An injector named lldprx attaches to two core FortiOS daemons, miglogd and iked, using Linux ptrace system calls. The injector halts execution, allocates executable memory regions, and inserts malicious code. This creates a covert, memory-resident communication bridge between the logging process and the primary VPN authentication service.
6Covert Authentication Bypass
The miglogd hook monitors transit traffic for embedded data markers including a link-local IP and specific port numbers. Upon detection, it extracts session tokens and writes them into the iked daemon's memory. When matching sessions arrive, the VPN daemon takes an alternate execution path, bypassing FortiOS security validations completely.
7Secondary C2 and Antiforensics
Attackers created an alternate reverse shell by abusing Apache's native mod_md certificate module on FortiGate devices. Embedded shell commands in domain validation requests triggered continuous outbound retries. Simultaneously, the operators disrupted telemetry by terminating miglogd and syslog daemons, wiping crash logs, and deleting rogue administrative accounts.
8Evolving Edge Architecture Risks
Detecting PEERSTITCH requires live process memory inspection for abnormal read-write-execute regions or NOP patches within core daemons. The campaign underscores how threat actors weaponize centralized management platforms to access downstream clients. Advanced edge malware increasingly shifts toward memory patching and legitimate protocol abuse to maintain prolonged persistence.