PEERSTITCH Malware Targets Fortinet Devices Using Stealthy In-Memory Code Injection

A suspected advanced threat actor has been observed exploiting a Fortinet security vulnerability to deploy a previously undocumented, memory-resident malware known as PEERSTITCH on ARM64-based devices. The malware operates directly in process memory, avoids leaving persistent binaries on disk, and uses legitimate system processes to conceal its communications.

The activity involves CVE-2025-61624, a path traversal vulnerability affecting the command-line interpreter in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. The flaw could allow a privileged attacker to write or delete arbitrary files through specially crafted arguments supplied to existing commands. Fortinet patched the vulnerability in April 2026.

Researchers from Palo Alto Networks Unit 42 discovered the activity while investigating a prolonged intrusion targeting a telecommunications managed service provider. The campaign, tracked as CL-STA-0954, also known as UNC5820, involved the exploitation of a separate FortiManager vulnerability, CVE-2024-47575, known as FortiJump.

Attackers Exploit Centralized Fortinet Infrastructure

The intrusion reportedly began in September 2024, when attackers exploited the FortiJump vulnerability to compromise a FortiManager appliance. Following the breach, they stole an archive containing sensitive configuration data, cryptographic material, and database files associated with more than 500 managed FortiGate firewalls.

The compromised information reportedly included:

  • Running configurations for more than 500 FortiGate firewalls across internal infrastructure and customer networks.
  • Serial numbers and management relationships for enrolled devices.
  • Central management SQLite databases.
  • Public IP addresses associated with managed firewalls.
  • Internal network topology maps, routing tables, and interface configurations.
  • Encrypted administrative, local, and SSL/VPN credentials.
  • Cryptographic trust material, including public certificates and private keys.

The stolen data enabled the attackers to map network infrastructure, establish persistent access, intercept network traffic, create unauthorized SSL/VPN sessions, and deploy backdoors. Researchers also observed the exploitation of CVE-2025-61624 to facilitate the deployment of PEERSTITCH.

The campaign demonstrates how compromising a centralized network management platform can expose multiple downstream environments managed through the same infrastructure.

How PEERSTITCH Malware Operates

PEERSTITCH is a 64-bit Linux ARM64 executable written in C. Unlike conventional malware that relies on persistent files or dedicated network connections, it operates through injected code inside legitimate FortiOS processes.

Researchers identified a deployment script that downloads five components from an external server at 23.240.77[.]233:8085:

  • pM.js: An environment preparation script that deletes itself after execution.
  • a.js: An Emscripten JavaScript runtime module saved as index.js.
  • a.wasm: A compiled WebAssembly module saved as index.wasm.
  • b.js: A deployment orchestrator saved as ipssem.js.
  • dd: A native ARM64 ELF binary injector saved as lldprx, which contains the core PEERSTITCH functionality.

After an execution delay, the orchestrator launches lldprx, which injects code into two important FortiOS processes: /bin/miglogd and /bin/iked.

In-Memory Injection and Covert Communication

The PEERSTITCH injector identifies the running processes associated with the two FortiOS daemons and examines their memory layouts. It then uses the Linux ptrace mechanism to attach to the processes, interrupt execution, allocate executable memory, write malicious code, and redirect execution through the injected payload.

This technique establishes a covert communication bridge between the two legitimate processes without requiring a conventional listening service or persistent malware binary.

The injected code in miglogd monitors traffic for specific markers:

  • TCP port marker: 8550, embedded within traffic data rather than opened as a listening port.
  • IP address marker: 169.254.0.1, used as a link-local identifier for pattern matching.

When the expected pattern is detected, the hook passes an associated session token or identifier to the iked daemon. The second hook searches for that identifier while processing subsequent VPN sessions.

If the identifier appears in the relevant injection buffer, the VPN daemon follows an alternative execution path that bypasses its default security validations for the affected session.

By modifying how legitimate FortiOS processes handle selected traffic, PEERSTITCH creates a stealthy, memory-resident mechanism for manipulating VPN session handling while attempting to evade conventional security monitoring.

Additional Persistence and Anti-Forensic Activity

Beyond PEERSTITCH, the attackers reportedly established a separate command-and-control channel by abusing Apache's native mod_md module on FortiGate firewalls to spawn an SSH-based reverse shell.

Researchers also observed attempts to impersonate the FortiManager platform to retrieve information from other managed firewalls across the targeted network.

The attackers demonstrated detailed knowledge of Fortinet appliance architecture, FortiOS internals, and management protocols. Researchers suggested that CVE-2024-26009 and CVE-2024-26008 may have been considered or exploited during parts of the activity, although this was not confirmed. Exploitation of those vulnerabilities requires the relevant device to be enrolled in FortiGate Cloud or FortiCloud SSO, which the affected firewalls were not.

The threat actor also took steps to remove forensic evidence, including terminating syslog generation, clearing crash logs, disrupting logging telemetry, and automatically deleting unauthorized administrator accounts and script objects after execution.

Mitigation and Security Recommendations

Organizations operating Fortinet appliances should prioritize the following actions:

  1. Apply security updates: Ensure FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager are updated to releases addressing CVE-2025-61624. Confirm the correct fixed version for each product using Fortinet's official advisory.
  2. Secure management interfaces: Restrict administrative access to trusted internal systems and minimize exposure of management services to untrusted networks.
  3. Review FortiManager access: Investigate unexpected access to centralized management appliances and verify that managed firewall configurations and administrative relationships remain legitimate.
  4. Inspect VPN activity: Review unusual SSL/VPN sessions, unauthorized administrative changes, and suspicious traffic involving managed firewalls.
  5. Investigate logging gaps: Unexpected termination of logging, missing crash records, or unexplained changes to administrator accounts may indicate attempts to conceal malicious activity.
  6. Assess downstream devices: If a centralized management appliance is compromised, investigate every connected firewall and customer network that may have been exposed through stolen configurations or credentials.

Because PEERSTITCH operates primarily in memory and abuses legitimate system processes, traditional file-based detection may be insufficient. Organizations should combine patch management with network monitoring, management-plane restrictions, configuration audits, and incident-response investigations.

The discovery highlights the growing risk posed by sophisticated malware targeting network edge infrastructure. By combining stolen management data, privileged exploitation, in-memory injection, and covert inter-process communication, the attackers were able to pursue persistent access while reducing the forensic artifacts available to defenders.