PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
Unit 42 says CL-STA-0954 used Fortinet flaws to deploy memory-resident PEERSTITCH against a telecom provider.
Palo Alto Networks Unit 42 says suspected cluster CL-STA-0954, also tracked as UNC5820, compromised a telecommunications managed service provider beginning in September 2024 by exploiting FortiJump, CVE-2024-47575, on FortiManager. The attackers stole configurations, certificates, private keys, and an inventory covering more than 500 managed FortiGate firewalls. They later exploited CVE-2025-61624, a FortiOS path-traversal flaw patched in April 2026, to deploy PEERSTITCH, a memory-resident ARM64 implant that uses ptrace to hook miglogd and iked and bypass checks on tagged SSL VPN sessions. The operators also disrupted logging, deleted rogue administrator accounts, and established an SSH reverse shell through Apache mod_md.