# PEERSTITCH Malware Weaponizes Fortinet Ecosystem to Compromise Hundreds of Firewalls Attackers leverage FortiManager and memory injection to silently hijack enterprise network perimeters. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-10-16 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/331fad44-3f60-47f2-b30a-d2a4e8d26369 ## Central Management Breach Palo Alto Networks Unit 42 uncovered a multi-stage intrusion from September 2024 tracked as CL-STA-0954 or UNC5820. Threat actors breached a telecommunications managed service provider via FortiManager vulnerability CVE-2024-47575, termed FortiJump. This single point of failure exposed configurations and cryptographic material covering more than 500 downstream firewalls. ## Rogue Registration Exploitation Attackers exploited CVE-2024-47575 over TCP port 541 to register an unauthenticated virtual device on the central FortiManager appliance. Within minutes, they extracted archives containing public IP addresses, routing tables, and cryptographic trust material. Reversible password ciphertext allowed threat actors to establish unauthorized SSL/VPN sessions directly into internal management segments. ## Privilege Escalation via Auto-Scripts After gaining access, the attackers leveraged CVE-2025-61624, a path traversal flaw in the FortiOS auto-script CLI engine. This vulnerability allowed arbitrary file manipulation to deploy a sophisticated toolchain. The payload delivered PEERSTITCH, an unrecorded 64-bit ARM64 binary written in C, downloaded alongside five modular staging components. ## Volatile Memory Operation PEERSTITCH executes entirely in volatile memory, writing no persistent binaries to disk and opening no listening ports. It initiates no outbound network connections, rendering standard endpoint detection ineffective. Fortinet's Integrity Checker Tool fails to detect the implant because it validates only on-disk files, which remain completely unmodified. ## Dual-Daemon Memory Injection An injector named lldprx attaches to two core FortiOS daemons, miglogd and iked, using Linux ptrace system calls. The injector halts execution, allocates executable memory regions, and inserts malicious code. This creates a covert, memory-resident communication bridge between the logging process and the primary VPN authentication service. ## Covert Authentication Bypass The miglogd hook monitors transit traffic for embedded data markers including a link-local IP and specific port numbers. Upon detection, it extracts session tokens and writes them into the iked daemon's memory. When matching sessions arrive, the VPN daemon takes an alternate execution path, bypassing FortiOS security validations completely. ## Secondary C2 and Antiforensics Attackers created an alternate reverse shell by abusing Apache's native mod_md certificate module on FortiGate devices. Embedded shell commands in domain validation requests triggered continuous outbound retries. Simultaneously, the operators disrupted telemetry by terminating miglogd and syslog daemons, wiping crash logs, and deleting rogue administrative accounts. ## Evolving Edge Architecture Risks Detecting PEERSTITCH requires live process memory inspection for abnormal read-write-execute regions or NOP patches within core daemons. The campaign underscores how threat actors weaponize centralized management platforms to access downstream clients. Advanced edge malware increasingly shifts toward memory patching and legitimate protocol abuse to maintain prolonged persistence. ## Sources covering this story - [Security Affairs — PEERSTITCH Malware Compromises 500 Firewalls via FortiManager Exploitation](https://securityaffairs.com/201077/malware/peerstitch-malware-how-attackers-compromised-500-firewalls-through-fortimanager.html) - [The Hacker News — PEERSTITCH Malware Exploits FortiOS to Bypass VPN Security Checks](https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._