PEERSTITCH: Malware Turns FortiGate Firewalls Into Espionage Platforms

In September 2024, Palo Alto Networks Unit 42 investigated a multi-stage intrusion against a telecommunications provider, tracked as cluster CL-STA-0954. Attackers compromised a central FortiManager appliance by exploiting CVE-2024-47575, exfiltrated configurations for more than 500 managed firewalls, and then deployed PEERSTITCH: a memory-resident ARM64 malware that hides inside legitimate FortiOS processes without leaving disk artifacts. The findings were published in October 2026, forcing a rethink of detection paradigms for perimeter security appliances.

From Compromised FortiManager to Mass Exfiltration

The attack began with the exploitation of CVE-2024-47575, a vulnerability dubbed "FortiJump" by the analysis community. Attackers gained access to a central FortiManager appliance—the system Fortinet uses to manage configurations for hundreds of distributed firewalls. From this position, they stole active configuration files for more than 500 FortiGates, along with SQLite databases, encrypted credentials, cryptographic keys, and network topology maps.

Unit 42 verified that the exfiltrated credentials were recoverable through brute-force techniques. The telecommunications provider was not merely a direct victim; access to its credentials opened extended supply-chain scenarios, with the potential to compromise the networks of end customers managed through that infrastructure.

Attackers subsequently impersonated the FortiManager platform to pull data from other firewalls in the target network. The compromise of a single centralized management point thus translated into lateral expansion of exceptional scope, demonstrating the inherent fragility of architectures that concentrate perimeter security control in a few nodes.

CVE-2025-61624: Path Traversal That Elevates an Admin to Root

For the next step, attackers exploited CVE-2025-61624, a CWE-22 path traversal vulnerability in the FortiOS system.auto-script engine. According to the NVD record, the vulnerability carries a CVSS 3.1 score of 6.0 (MEDIUM) with vector AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H. It requires an authenticated attacker with an administrative profile and read-write permissions, but once those conditions are met, it allows reading and writing arbitrary files as root via specific CLI commands.

Unit 42 documented the concrete mechanism: the FortiOS system.auto-script engine permits specifying a relative path that, through directory traversal sequences such as ../../../../setup, bypasses intended restrictions and enables writing to reserved filesystem locations. This capability served as the vehicle for installing PEERSTITCH.

"PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections. Instead, it communicates through traffic generated by legitimate processes on the infected host, which makes the malware resistant to conventional endpoint and network detection." — Unit 42 (Palo Alto Networks)

PEERSTITCH Anatomy: Ghost Architecture in Silicon

PEERSTITCH represents a significant evolution in malware design for network appliances. It is a 64-bit Linux ARM64 executable, written in C and statically linked to glibc. Its defining characteristic is the complete absence of disk persistence: once loaded into memory, the malware scrubs its own traces from the filesystem and operates exclusively in the appliance's RAM.

Operation unfolds in two injection phases. PEERSTITCH acts as a one-shot injector targeting two fundamental FortiOS daemons: /bin/miglogd, responsible for system log management, and /bin/iked, the IKE/IPsec daemon that manages VPNs. Injection into these processes legitimizes the malware's traffic, masking it as ordinary appliance activity.

The original payload was downloaded from an external server at hxxp[:]//23.240.77[.]233:8085/ in five distinct components: pM.js, a.js (saved as index.js), a.wasm (saved as index.wasm), b.js (saved as ipssem.js), and dd (saved as lldprx). The presence of a compiled WebAssembly module among the components indicates a level of sophistication uncommon in embedded appliance malware, though Unit 42 did not specify the exact role of this module in the overall operation.

The malware intercepts traffic on 11 specific services on TCP ports, creating a passive sniffing capability that does not require opening its own listening sockets. All communication occurs through two external staging IP addresses: 23.240.77[.]233 and 47.18.167[.]159. This architecture makes PEERSTITCH particularly insidious: network monitoring systems that rely on detecting suspicious connections or anomalous listening ports see no anomaly, because exfiltration traffic flows through already legitimate channels.

Why It Matters

The CL-STA-0954 case exposes a structural paradox of perimeter cybersecurity. FortiGate appliances are designed to inspect, filter, and protect network traffic; when compromised, they become espionage platforms with native visibility into flows that operators consider protected. PEERSTITCH's memory-resident technique nullifies two conventional detection pillars: filesystem analysis for malicious payloads and network connection monitoring for beacons to hostile infrastructure.

The attacked telecommunications provider managed connectivity and security for hundreds of entities on behalf of third parties. The exfiltration of its credentials and configurations is not limited to the compromise of a single perimeter: it generates an extended supply-chain risk whose scope is not bounded by the Unit 42 investigation, which examined only the provider's environment without extending to end-customer networks.

It is unclear whether PEERSTITCH has been observed in other incidents beyond CL-STA-0954, or whether Fortinet has released specific patches for CVE-2025-61624 at the time of the report's publication. The dossier does not specify the exact vector for decrypting the exfiltrated credentials, nor does it attribute the attack to a specific named nation-state: Unit 42 notes only tradecraft overlaps with intrusions attributed to suspected state threat actors.

Questions and Answers

Why is PEERSTITCH defined as "memory-resident" rather than "fileless"?

Unit 42 explicitly describes PEERSTITCH as lacking persistent binaries on disk, but the term "fileless" is often misused for malware that leverages scripts or system tools already present. PEERSTITCH is a compiled ARM64 executable that is loaded into memory and then deleted from the filesystem: its persistence is purely RAM-based, distinguishing it from both traditional on-disk malware and the more common fileless techniques on Windows platforms.

How does injection into miglogd and iked make traffic indistinguishable?

The two daemons are legitimate FortiOS processes with respective functions of log management and IPsec VPN. Once compromised, the malware can use the sockets and connections already opened by these processes to ferry its own data. Detection systems that rely on correlating suspicious processes with anomalous connections find only trusted system processes and traffic on expected protocols.

What is the significance of the WebAssembly module in the payload?

The Unit 42 dossier lists a component "a.wasm (saved as index.wasm)" among the downloaded files but does not detail its function. It is not possible to determine whether the Wasm module executes specific malware logic, serves as an obfuscation component, or enables future payload portability to other architectures. The brief does not document this aspect.

Sources

• https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
• https://www.cve.org/CVERecord?id=CVE-2024-47575
• https://nvd.nist.gov/vuln/detail/cve-2025-61624

Information is based on the cited source and current as of publication.

Sources