PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH.

The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a privileged attacker to achieve arbitrary write or delete files via specifically crafted arguments to existing commands. It was patched by Fortinet in April 2026.

"PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections," Palo Alto Networks Unit 42 researchers Daniel Gott and Shawn Westfall said. "Instead, it communicates through traffic generated by legitimate processes on the infected host, which makes the malware resistant to conventional endpoint and network detection."

The cybersecurity company said it discovered the activity as part of its prolonged network intrusion against a telecommunications managed service provider that took place in September 2024. The multi-stage network intrusion is being tracked as CL-STA-0954 (aka UNC5820), with initial access obtained by exploiting a critical Fortinet FortiManager flaw dubbed FortiJump (CVE-2024-47575).

Following a successful compromise of the appliance, the attackers are said to have exfiltrated an archive containing running configurations, cryptographic material, and database files containing information about more than 500 managed FortiGate firewalls. Some of the harvested details are listed below -

• The FortiManager appliance's own serial number and its management relationships to every enrolled device
• Running configuration files for more than 500 managed FortiGate firewalls across internal infrastructure and client networks
• Central management SQLite databases
• An inventory listing more than 500 FortiGate serial numbers alongside their respective public IP addresses
• Internal network topology maps, routing tables and interface configurations
• Ciphertext administrative, local, and SSL/VPN credentials
• Encoded cryptographic trust material, including public certificates, and private keys

The stolen information was then used to conduct network reconnaissance, establish long-term access, intercept network traffic, set up unauthorized FortiGate SSL/VPN sessions to perimeter firewalls, deploy backdoors, and exploit a separate privilege-escalation vulnerability (i.e., CVE-2025-61624) to deploy PEERSTITCH.

The malware is a 64-bit Linux ARM64 executable written in C. It includes an auto-script designed to download five components from an external server ("23.240.77[.]233:8085") -

• pM.js, an environment preparation script (self-deleting)
• a.js (saved as index.js), an Emscripten JavaScript runtime module
• a.wasm (saved as index.wasm), a compiled WebAssembly binary module
• b.js (saved as ipssem.js), a deployment orchestrator script
• dd (saved as lldprx), a native ARM64 ELF binary injector (PEERSTITCH core)

The main phase of the attack begins after an execution delay. The orchestrator ("ipssem.js") launches "lldprx," which then serves as a process memory patching injector targeting two core FortiOS daemons: "/bin/miglogd" and "/bin/iked."

Specifically, it locates the running processes associated with the two daemons, enumerates their memory layout, attaches to them using ptrace and halts their execution using PTRACE_INTERRUPT, allocates executable memory and writes malicious code into it, and redirects execution through the injected code.

The end goal behind this hooking step is to create a "covert, memory-resident communication bridge" between the two legitimate FortiOS processes instead of using a conventional network connection or file, and use them as a cover to sidestep detection.

Specifically, the miglogd hook is equipped to recognize a marker in the data it is passing through the process. This includes two specific markers -

• TCP port marker - 8550 (embedded within traffic data, not a listening port)
• IP address marker - 169.254.0.1 (link-local identifier used for pattern matching)

Once this pattern is identified, it passes the associated session token or identifier to the iked daemon, whose hook later looks for that identifier while handling subsequent VPN sessions. If such a tag exists within that VPN session's injection buffer, it takes an alternative execution path, bypassing default FortiOS security validations.

Put differently, the hooks injected into the two FortiOS processes change how the VPN daemon handles particular sessions.

Besides deploying PEERSTITCH, the attackers have been observed establishing a separate command-and-control (C2) channel by leveraging the native Apache "mod_md" module on FortiGate firewalls in order to spawn an SSH-based reverse shell.

"The attackers also impersonated the FortiManager platform to pull from managed firewalls of other hosts in the targeted network," the researchers said. "The attackers demonstrated proficiency in Fortinet appliance architecture, FortiOS internals and FortiOS management protocols."

Although not definitive, it's suspected that the attackers may have exploited other flaws like CVE-2024-26009 and CVE-2024-26008 to carry out this task. However, Unit 42 emphasized that exploiting these vulnerabilities requires the device to be enrolled in FortiGate Cloud/FortiCloud SSO, which none of the affected firewalls held.

In addition, CL-STA-0954 has been identified as undertaking various measures to remove forensic artifacts through termination of syslog generation, crash log clearing, logging telemetry disruption, and automatic deletion of rogue administrator accounts and auto-script objects after execution.

"This intrusion highlights a growing threat, the weaponization of centralized edge management ecosystems to compromise downstream networks," Unit 42 said. "The discovery of the PEERSTITCH implant demonstrates the increasing technical maturity of edge-device malware."

"By operating as a one-shot injector, avoiding persistent disk artifacts and building a covert inter-process communication bridge inside process memory, the attackers achieved sustained persistence while evading traditional monitoring."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.