New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory

PEERSTITCH, a memory-resident ARM64 implant deployed against FortiGate firewalls during a prolonged intrusion into a telecommunications managed service provider.

The malware hijacks legitimate FortiOS processes, leaving no persistent executable, opening no listening ports, and initiating no outbound connections of its own.

Published October 14, the investigation tracks the activity as CL-STA-0954, also known as UNC5820.

Researchers did not investigate customer networks or confirm downstream customer compromises.

Initial access involved CVE-2024-47575, the missing-authentication vulnerability commonly called FortiJump.

Attackers abused the management channel on TCP port 541 and registered a rogue virtual appliance named localhost, using serial number FMG-VMTM23017412. They subsequently exfiltrated a configuration archive named .tm.

The archive contained running configurations, administrative databases, network topology, encrypted credentials, certificates and private keys.

Unit 42 confirmed that administrative and SSL/VPN passwords were recoverable from the stolen configurations.

Attackers subsequently used legitimate credentials to establish unauthorized VPN sessions from infrastructure including 23.240.77[.]233 and 47.18.167[.]159.

They also pushed unauthorized packet-capture configurations to managed firewalls, targeting HTTP traffic and services including TFTP, RADIUS and LDAP.

These captures supported credential interception, authentication monitoring and internal reconnaissance.

Deployment relied on CVE-2025-61624, a privileged path-traversal vulnerability in Fortinet’s command-line interpreter.

During this intrusion, attackers abused unsanitized system.auto-script object names to escape intended directories and execute a loader with underlying operating-system privileges.

This crossed the boundary between restricted FortiOS administration and root-level process control.

Unit 42 said in a report shared with GBhackers, the intrusion began in September 2024 by exploiting a centralized FortiManager appliance, exposing configurations and cryptographic material tied to more than 500 managed firewalls.

PEERSTITCH Malware

The staging chain downloaded JavaScript, WebAssembly and a native ARM64 injector into /data2/template/. Named lldprx, the C-based, statically linked injector targeted /bin/miglogd, responsible for logging, and /bin/iked, which handles IKE/IPsec negotiations.

Although staging involved disk files, the injector deleted its executable after installation.

Using ptrace, PEERSTITCH attached to both daemons, captured their register states and allocated 16,384-byte anonymous memory regions with read, write and execute permissions.

It injected a 1,344-byte payload and patched execution paths to redirect legitimate routines into malicious hooks.

The hooks inspected existing process traffic for embedded markers, including 8550 and 169.254.0.1. These were matching values, not a newly opened listening port or an external command server.

Extracted session identifiers moved between daemons through direct writes to /proc//mem. Matching identifiers subsequently triggered alternate execution paths inside iked, bypassing default security validations.

Alongside PEERSTITCH, attackers weaponized Apache’s mod_md certificate-management module. Malicious ACME configuration mapped DNS-01 challenges to /bin/node, enabling an SSH reverse shell.

This separate channel generated outbound communications, unlike PEERSTITCH’s passive, process-resident mechanism.

Unit 42 also assessed management-platform impersonation with medium confidence, but could not distinguish stolen trust-material reuse from CVE-2024-26009 exploitation.

Related FortiCloud SSO vulnerabilities were excluded because affected devices lacked the required enrollment.

Defenders should inspect miglogd and iked for anonymous 16 KB executable mappings, cross-process memory writes, traversal-bearing auto-scripts and unexplained logging interruptions.

Fortinet lists FortiOS 7.4.10 and 7.6.5 as fixed releases for CVE-2025-61624. Compromised management credentials, certificates and keys require rotation; patching alone does not invalidate stolen trust.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.