Cybersecurity researchers have identified a previously undocumented malware strain called PEERSTITCH that has been deployed through exploitation of a Fortinet FortiOS vulnerability, allowing attackers to establish covert access inside affected systems. The memory resident ARM64 malware was discovered during an investigation into a prolonged network intrusion targeting a telecommunications managed service provider. Researchers from Palo Alto Networks Unit 42 said the malware demonstrates advanced techniques designed to avoid traditional security monitoring by operating primarily within system memory rather than leaving conventional files on disk. The activity is being tracked as CL-STA-0954, also associated with UNC5820, and involved multiple stages of compromise targeting Fortinet infrastructure.
The attack chain involved exploitation of CVE-2025-61624, a path traversal vulnerability affecting the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. The vulnerability, which carries a CVSS score of 5.4, could allow a privileged attacker to write or delete files through specially crafted arguments provided to existing commands. Fortinet patched the issue in April 2026. According to Unit 42 researchers Daniel Gott and Shawn Westfall, PEERSTITCH does not maintain a persistent binary on affected systems, does not open listening ports, and does not create direct outbound network connections. Instead, the malware communicates through traffic generated by legitimate processes running on the compromised host, making detection more difficult through traditional endpoint and network security solutions. Researchers said the intrusion began with the compromise of a FortiManager appliance through a separate critical Fortinet vulnerability known as FortiJump, tracked as CVE-2024-47575. Following access to the appliance, attackers reportedly obtained an archive containing running configurations, cryptographic material, and database information related to more than 500 managed FortiGate firewalls. The collected information included device serial numbers, management relationships, configuration files, network topology details, routing information, interface settings, encrypted administrative and VPN credentials, as well as cryptographic trust materials such as certificates and private keys. According to Unit 42, the information was later used for network reconnaissance, establishing unauthorized access, monitoring network traffic, creating SSL VPN sessions, deploying additional access mechanisms, and exploiting CVE-2025-61624 to deliver PEERSTITCH.
PEERSTITCH is a 64 bit Linux ARM64 executable written in C that uses a multi component deployment process. Researchers identified several components downloaded from an external server, including preparation scripts, JavaScript runtime modules, WebAssembly components, a deployment orchestrator, and the core ARM64 injector responsible for the malware’s main functionality. After an execution delay, the deployment orchestrator launches the injector, which targets two FortiOS processes, miglogd and iked. The injector uses process memory manipulation techniques, including ptrace, to attach to running processes, allocate executable memory, insert malicious code, and redirect execution toward attacker controlled functionality. This allows the malware to create a covert communication channel between legitimate FortiOS processes instead of relying on traditional files or external connections. The injected modifications allow PEERSTITCH to identify specific markers within process traffic, including a TCP port marker associated with port 8550 and an IP address marker linked to 169.254.0.1. Once detected, the malware transfers session information between modified processes, allowing specific VPN sessions containing matching identifiers to follow altered execution paths and bypass standard security checks. Researchers also observed a separate command and control mechanism involving the use of the Apache mod_md module on FortiGate devices to establish an SSH based reverse shell. Unit 42 noted that the activity showed significant familiarity with Fortinet appliance architecture, FortiOS internals, and management protocols.
While researchers have not confirmed the exploitation of additional vulnerabilities, they said attackers may have attempted to use other Fortinet flaws, including CVE-2024-26009 and CVE-2024-26008, although successful exploitation would require specific conditions that were not present on the affected firewalls. The investigation also identified efforts to remove forensic traces, including disabling logging activities, clearing crash records, disrupting telemetry collection, and removing unauthorized administrator accounts and automation objects after execution. Unit 42 said the incident highlights the increasing focus on edge device ecosystems as targets for sophisticated attacks and demonstrates how memory based malware can help threat actors maintain access while reducing visible indicators of compromise.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
