Unit 42 Reveals PEERSTITCH Implant Targeting FortiGate Firewalls

Palo Alto Networks Unit 42 researchers disclosed details of a sophisticated intrusion campaign involving the deployment of PEERSTITCH, a novel memory-resident malware targeting Fortinet infrastructure. The investigation, published in a report tracking the activity as cluster CL-STA-0954, reveals how attackers leveraged a known vulnerability to breach a telecommunications managed service provider in September 2024.

The threat actors, identified as UNC5820, gained initial access by exploiting CVE-2024-47575, also referred to as FortiJump, against a centralized FortiManager appliance. This unauthenticated remote code execution flaw allowed the attackers to send crafted requests to the FMG-Access management channel on TCP port 541. From this single entry point, they registered a rogue Virtual FortiGate appliance named localhost to the central instance using external infrastructure.

Technical Details and Malware Behavior

Following the initial compromise, the attackers exfiltrated a configuration archive containing running configurations, cryptographic material, and database files. This stolen data included information regarding more than 500 managed FortiGate firewalls that protected both the target’s internal infrastructure and its clients’ networks. The archive also contained SQLite databases with administrative domains and device revision metadata, along with a text inventory listing serial numbers and public IP addresses.

The intruders then exploited a separate privilege-escalation vulnerability, CVE-2025-61624, via a FortiOS auto-script path traversal flaw. This second exploit facilitated the deployment of PEERSTITCH, a memory-resident ARM64 malware. According to Unit 42, PEERSTITCH leaves no persistent binary on disk, opens no listening ports, and initiates no outbound network connections. Instead, it communicates through traffic generated by legitimate processes on the infected host, making it resistant to conventional endpoint and network detection methods.

Scope and Attribution

The investigation focused on the telecommunications provider’s own environment, and Unit 42 did not examine the client networks whose firewalls the provider managed. The exposure described in the report involves configuration and credential material rather than confirmed intrusions into those external networks. The attackers demonstrated a high level of proficiency in Fortinet appliance architecture and FortiOS management protocols, with post-exploitation activities overlapping with intrusions attributed to suspected nation-state actors.

Palo Alto Networks stated that its customers are better protected from this activity through Advanced URL Filtering, Advanced DNS Security, and Advanced IP Defense. The company also noted that Next-Generation Firewall with Advanced Threat Prevention provides additional mitigation against such threats.

What should you do?

Organizations using Fortinet equipment should review their FortiManager logs for unauthorized device registrations, particularly those originating from external IP addresses. Security teams should monitor for unusual traffic patterns that may indicate memory-resident malware communicating through legitimate processes. Administrators should ensure that management channels, such as the FMG-Access port, are restricted to trusted internal networks only.

What to do and how to stay safe: PEERSTITCH

• Audit FortiManager appliances for rogue device registrations and unauthorized access to the FMG-Access management channel.
• Monitor network traffic for anomalies that could indicate memory-resident malware communicating through legitimate host processes.
• Verify that configuration archives and cryptographic materials have not been exfiltrated from centralized management systems.
• Review access controls for FortiOS auto-script functions to mitigate potential path traversal vulnerabilities.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is PEERSTITCH?

PEERSTITCH is a novel, memory-resident ARM64 malware deployed by attackers to infect FortiGate firewalls without leaving persistent binaries on disk.

How did the attackers gain initial access?

The attackers exploited CVE-2024-47575, an unauthenticated remote code execution vulnerability in FortiManager, to register a rogue device and steal configurations.

How many firewalls were potentially affected?

Configuration data for more than 500 managed FortiGate firewalls was exfiltrated from the compromised FortiManager appliance.