Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls

Attackers compromised a telecommunications managed service provider by exploiting vulnerabilities in Fortinet’s centralized management and firewall systems, then deployed PEERSTITCH, a stealthy malware implant that runs inside FortiGate processes.

Unit 42 says the activity began with a breach of a FortiManager appliance and exposed configurations and sensitive data linked to more than 500 managed FortiGate firewalls.

The researchers say this exposure did not confirm that the clients’ firewalls were also compromised. In the September 2024 intrusion, the attackers exploited CVE-2024-47575, also known as FortiJump, against FortiManager.

The flaw let an unauthenticated remote attacker send crafted requests through the device’s management channel and run commands. Unit 42 reported that the attackers registered a rogue device, created an archive and stole it.

The archive included firewall configurations, network details, credentials and cryptographic trust material. Analysts from Unit 42 identified PEERSTITCH while investigating the intrusion, which they track as CL-STA-0954, also known as UNC5820.

Their technical report on the FortiGate implant describes a multi-stage operation that moved from FortiManager compromise to credential use, network monitoring and malware deployment.

The stolen archive gave the attackers a map of the managed environment: device serial numbers and public IP addresses, network routes, firewall rules, and management relationships.

It also contained encrypted administrative and VPN credentials and certificates used to establish trust between FortiManager and managed devices. Unit 42 says researchers were able to recover administrative and VPN passwords from the stolen configuration files.

After a period of inactivity, the attackers used the compromised management platform to push unauthorized packet-capture settings to some managed firewalls.

These rules monitored unencrypted HTTP traffic and selected services, including remote administration and network discovery. The researchers also observed captures aimed at TFTP, RADIUS and LDAP traffic, which could reveal files, authentication data and directory activity.

Hackers Exploit Fortinet Vulnerabilities

Using recovered credentials, the attackers then opened unauthorized FortiGate VPN sessions and reached internal network-management areas.

The operation shows how a compromise of a central management system can expose other connected devices: the attackers used stolen trust material and device information to continue their activity beyond the first appliance.

Cybersecurity News has previously covered the FortiManager zero-day vulnerability exploited and the mass compromise of FortiManager devices, which provide background on the earlier exploitation of CVE-2024-47575.

Unit 42 says the attackers exploited a second flaw, CVE-2025-61624, through FortiOS’s system.auto-script feature. The path traversal issue allowed an authenticated administrator to write files outside the intended directory, with the script running at root level.

That access helped the attackers move from a restricted administrative interface to control of the firewall’s underlying operating system.

The attackers used a traversal string in an auto-script object to place a loader on selected devices. The loader fetched several files, including JavaScript and WebAssembly components, plus a native ARM64 executable named lldprx.

After a delay, the deployment script launched the executable, which searched for two FortiOS processes: miglogd, responsible for logging, and iked, which handles IKE and IPsec VPN functions.

The injector attached to both processes and created a 16-kilobyte memory area with read, write and execute permissions. It placed its payload there and altered execution paths in the daemons.

PEERSTITCH then used process memory to pass session tags between miglogd and iked. When VPN traffic matched specific markers, the implant could take an alternate code path that bypassed normal FortiOS security checks.

This design makes the implant difficult to find with routine checks. It does not leave a persistent malware binary on disk, open a listening port or make its own outbound connection. Instead, it hides its activity inside legitimate system processes and their existing traffic.

A second channel and efforts to hide activity

The researchers also found that the attackers misused Apache’s mod_md module, which supports automated certificate management, to set up a reverse shell.

They altered configuration so that certificate-validation activity could run commands through Node.js and repeatedly contact attacker infrastructure. This gave the attackers a separate route for remote control alongside the memory-based implant.

To make investigation harder, the attackers stopped logging services, cleared crash logs, removed rogue accounts and auto-script objects, and replaced a malicious Apache configuration file with harmless-looking text. The lldprx injector also deleted its own file and stopped the staging process before exiting.

Organizations should review FortiManager and FortiGate records for unexpected device registrations, unfamiliar administrator accounts, suspicious VPN sessions, and auto-script entries containing path traversal strings such as ../../.

They should compare firewall configurations with known-good backups and treat credentials, certificates and trust material stored on a compromised management server as exposed.

Cybersecurity News has also covered a FortiGate firewall configuration leak, a reminder that stolen firewall settings can reveal credentials and network design.

For PEERSTITCH-specific hunting, Unit 42 recommends examining the memory maps of miglogd and iked for anonymous 16-kilobyte regions with read, write and execute permissions. Investigators should also check for memory patches at the offsets listed below, cross-process writes to /proc/<pid>/mem, relevant daemon crashes, and suspicious auto-script objects.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.