PEERSTITCH implant lets attackers' VPN sessions skip FortiGate security checks

Palo Alto Networks' Unit 42 has disclosed PEERSTITCH, a stealthy in-memory implant for Fortinet FortiGate firewalls that lets attacker-tagged VPN sessions bypass default FortiOS security validations. In a report published on October 14, researchers Daniel Gott and Shawn Westfall said the malware was found during a long-running intrusion at a telecommunications managed service provider, tracked as cluster CL-STA-0954 (also known as UNC5820). The case shows how a compromised central management platform can expose hundreds of downstream networks.

What happened

According to Unit 42, the intrusion began in September 2024, when the attackers exploited the FortiManager flaw known as FortiJump (CVE-2024-47575) and registered a rogue virtual FortiGate. They then generated and exfiltrated an archive containing configurations, credentials, certificates, private keys and topology data for more than 500 managed FortiGate firewalls. After an extended dwell period, they pushed sniffer configurations to downstream firewalls, used recovered credentials for SSL VPN access and impersonated FortiManager to reach other devices, the report says.

To gain root access and deliver the implant, the attackers exploited CVE-2025-61624, a path traversal flaw in the FortiOS command line interpreter that Fortinet patched in April 2026, The Hacker News reported. Unit 42 did not attribute the activity to a named country or group, and noted it examined only the provider's own environment, not its clients' networks.

Technical details

Unit 42 describes PEERSTITCH as a statically linked ARM64 Linux executable written in C that acts as a one-shot ptrace injector. It attaches to the /bin/miglogd logging daemon and the /bin/iked IKE/IPsec daemon, allocates a 16 KB executable memory region and patches their code. According to The Hacker News, it "leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections." The two hooks communicate through /proc/<pid>/mem, tagging VPN sessions so that iked takes an alternative path that skips default checks. The attackers also abused the Apache mod_md module on FortiGate devices for an SSH-based reverse shell and disrupted logging to cover their tracks.

What to do

Organizations should ensure FortiOS is patched against CVE-2025-61624 and FortiManager against CVE-2024-47575. Unit 42 stresses that patching alone does not end a compromise: credentials, certificates and other cryptographic material held by a compromised management platform should be treated as compromised and rotated, and management interfaces should be isolated. For hunting, the researchers recommend looking for anonymous 16,384-byte rwxp memory regions in miglogd and iked, writes to /proc/<pid>/mem between the two processes, Signal 11 crashes via diagnose debug crashlog read, and auto-script objects containing ../ strings. The report lists network indicators including 23.240.77[.]233 and 45.32.41[.]202, along with file hashes and a YARA rule.