PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

Recent investigations have revealed that an advanced threat actor has exploited a critical security flaw within Fortinet's FortiOS to deploy a novel form of memory-resident ARM64 malware named PEERSTITCH.

The attack primarily utilizes CVE-2025-61624 (with a CVSS score of 5.4), a path traversal vulnerability present in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. This flaw enables a privileged attacker to perform arbitrary write or deletion of files through specially crafted commands. Fortinet addressed this vulnerability in an April 2026 patch release.

According to researchers from Palo Alto Networks’ Unit 42, "PEERSTITCH does not leave any persistent binary on disk, does not initiate any listening ports, nor does it create outbound network connections." Instead, it covertly communicates using traffic generated by legitimate processes operating on the compromised host, thereby making traditional endpoint and network detection methods ineffective.

This recent discovery stems from a comprehensive investigation into a multi-stage network intrusion against a telecommunications managed service provider in September 2024. This intrusion has been designated as CL-STA-0954 (also referred to as UNC5820), with the initial compromise achieved through exploitation of a significant Fortinet FortiManager vulnerability, known as FortiJump (CVE-2024-47575).

Upon breaching the FortiManager appliance, the attackers exfiltrated sensitive data that included:

• The serial number of the FortiManager appliance and its management relations with other enrolled devices
• Configuration files from over 500 managed FortiGate firewalls across both internal systems and client networks
• Central management SQLite databases
• A comprehensive inventory of over 500 FortiGate serial numbers with their corresponding public IP addresses
• Detailed internal network topology maps, routing tables, and interface configurations
• Encrypted administrative, local, and SSL/VPN credentials
• Encoded cryptographic trust materials, including both public certificates and private keys

The acquired data facilitated network reconnaissance activities, the establishment of persistent access, interception of network traffic, unauthorized setup of FortiGate SSL/VPN sessions to perimeter firewalls, backdoor deployments, and utilization of a separate privilege-escalation vulnerability (CVE-2025-61624) to implement PEERSTITCH.

PEERSTITCH is characterized as a 64-bit Linux ARM64 executable written in the C programming language. It incorporates an auto-script designed to download five essential components from an external server ("23.240.77[.]233:8085"):

• pM.js, an environment preparation script (which self-deletes)
• a.js (stored as index.js), an Emscripten JavaScript runtime module
• a.wasm (stored as index.wasm), a compiled WebAssembly binary module
• b.js (saved as ipssem.js), a script that orchestrates deployment
• dd (stored as lldprx), a native ARM64 ELF binary injector (which forms the core of PEERSTITCH)

The attack's critical phase initiates following a programmed execution delay. During this phase, the orchestrator ("ipssem.js") launches "lldprx," which acts as a process memory patching injector targeting two core FortiOS daemons: "/bin/miglogd" and "/bin/iked."

This process involves the identification of the active processes associated with the two daemons, mapping their memory structure, attaching to them via ptrace, halting their execution using PTRACE_INTERRUPT, allocating executable memory, and writing malicious code to this memory. The execution flow is then redirected to the injected code.

The primary objective of this hooking step is to establish a "covert, memory-resident communication bridge" between the two legitimate FortiOS processes, thereby circumventing the use of conventional network connections or files, and obfuscating the attack from detection.

Notably, the miglogd hook has the capability to detect a specific marker within the data it processes. This includes:

• TCP port marker - 8550 (embedded within traffic data, functioning as a non-listening port)
• IP address marker - 169.254.0.1 (a link-local identifier utilized for pattern matching)

Once these patterns are detected, the corresponding session token or identifier is transferred to the iked daemon. The hook associated with iked subsequently monitors for that identifier while managing incoming VPN sessions. If the tag is present in the injection buffer of the VPN session, the system follows an alternate execution path, bypassing the routine security validations of FortiOS.

In essence, the hooks that have been injected into the two FortiOS processes modify the manner in which the VPN daemon processes specific sessions.

In addition to the deployment of PEERSTITCH, the attackers were also seen establishing a secondary command-and-control (C2) channel by utilizing the native Apache "mod_md" module present on FortiGate firewalls to initiate an SSH-based reverse shell.

"The attackers further masqueraded as the FortiManager platform to extract data from managed firewalls within the targeted network," noted the researchers. "This illustrates a sophisticated understanding of Fortinet appliance architecture, FortiOS internals, and FortiOS management protocols."

While it remains inconclusive, there is a strong suspicion that the attackers might have leveraged additional vulnerabilities such as CVE-2024-26009 and CVE-2024-26008 for their operations. Nonetheless, Unit 42 emphasizes that the exploitation of these vulnerabilities necessitates enrollment in FortiGate Cloud/FortiCloud SSO, which was not applicable in the case of the affected firewalls.

Moreover, CL-STA-0954 has demonstrated various techniques aimed at erasing forensic evidence, including the termination of syslog generation, clearing of crash logs, disruption of logging telemetry, and automatic removal of rogue administrator accounts and auto-script objects post-execution.

"This intrusion serves as a stark reminder of the escalating threat posed by the weaponization of centralized edge management systems to infiltrate downstream networks," commented Unit 42. "The identification of the PEERSTITCH implant underscores a notable advancement in the technical sophistication of malware targeting edge devices."

"By functioning as a single-injection mechanism, evading persistent disk traces, and constructing a covert inter-process communication bridge within memory, the attackers have secured enduring access while effectively evading traditional monitoring systems."