New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory
Unit 42 details PEERSTITCH, a memory-resident implant used against FortiGate firewalls at a telecom MSP.
Unit 42 reported PEERSTITCH, a memory-resident ARM64 implant used by CL-STA-0954, also known as UNC5820, during a long intrusion at a telecommunications managed service provider. Attackers first exploited CVE-2024-47575, FortiJump, on FortiManager in September 2024 and stole configuration archives tied to more than 500 managed firewalls, including recoverable administrative and SSL VPN credentials and private keys. They later abused CVE-2025-61624 to run a loader that used ptrace to hook FortiOS processes miglogd and iked, while a separate malicious ACME setup provided an SSH reverse shell. Fortinet lists FortiOS 7.4.10 and 7.6.5 as fixes for CVE-2025-61624; researchers could not confirm exploitation of CVE-2024-26009.