PEERSTITCH implant alters FortiOS VPN validation in memory
Palo Alto Networks Unit 42 has detailed PEERSTITCH, a previously unreported memory-resident ARM64 malware used in an intrusion affecting a telecommunications managed service provider. The attackers exploited CVE-2025-61624, a path traversal flaw in the command-line interpreter of Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, to deploy the implant. Fortinet patched the vulnerability, rated CVSS 5.4, in April 2026.
The activity was part of a prolonged intrusion that began in September 2024 and is tracked as CL-STA-0954, also known as UNC5820. Initial access came through FortiJump, CVE-2024-47575, a critical FortiManager vulnerability. After compromising the appliance, the attackers extracted an archive containing configurations, cryptographic material and database files related to more than 500 managed FortiGate firewalls.
Stolen FortiManager data enabled downstream access
The archive included the FortiManager serial number, management relationships, FortiGate running configurations, central-management SQLite databases, serial-number and public-IP inventories, topology information, routing data and interface settings. It also contained ciphertext administrative, local and SSL/VPN credentials, plus encoded trust material including certificates and private keys.
Unit 42 said the stolen information supported reconnaissance, long-term access, traffic interception and unauthorized FortiGate SSL/VPN sessions against perimeter firewalls. The operators also impersonated the FortiManager platform to pull information from managed firewalls belonging to other hosts in the targeted network. Researchers said the group demonstrated proficiency in Fortinet appliance architecture, FortiOS internals and management protocols.
Hooks create a covert bridge inside FortiOS processes
PEERSTITCH is a 64-bit Linux ARM64 executable written in C. Its deployment chain downloads five components, including JavaScript and WebAssembly modules, an orchestration script and the native ARM64 injector. Following a delay, the orchestrator launches the injector, which targets the core FortiOS daemons miglogd and iked.
The injector locates the processes, examines their memory layout, attaches through ptrace, interrupts execution, allocates executable memory, writes malicious code and redirects execution into that code. It does not leave a persistent binary on disk, open a listening port or initiate an outbound network connection. Instead, it uses traffic generated by legitimate host processes as cover.
The hook in miglogd recognizes traffic containing TCP port marker 8550 and the link-local identifier 169.254.0.1. These are embedded markers rather than a listening service or ordinary network destination. When the pattern appears, the hook passes a related session token or identifier to iked.
The iked hook then searches for that identifier while processing later VPN sessions. A matching tag in the session injection buffer sends handling down an alternative execution path that bypasses default FortiOS security validations. This creates a covert, memory-resident communication bridge between legitimate processes instead of relying on a conventional network channel or file.
Logging disruption complicates investigation
Alongside PEERSTITCH, the attackers established another command-and-control channel by using FortiGate's native Apache mod_md module to spawn an SSH-based reverse shell. Unit 42 also observed measures intended to remove forensic evidence, including terminating syslog generation, clearing crash logs, disrupting logging telemetry and automatically deleting rogue administrator accounts and auto-script objects after execution.
For organizations using Fortinet management infrastructure, the practical implication is to treat a FortiManager compromise as a potential route into every enrolled perimeter device. Teams should apply available patches, protect administrative access, review management relationships and investigate logging disruption, unexpected administrator objects, and anomalous VPN session handling.