PEERSTITCH: The Memory-Only Malware Hiding Inside Your FortiOS Daemons
A sophisticated threat actor has been caught exploiting a FortiOS vulnerability to deploy PEERSTITCH, a previously unknown piece of malware that exists entirely in memory and goes out of its way to look like nothing is happening.
The attack exploits CVE-2025-61624, a path traversal flaw in the FortiOS command line interpreter, also affecting FortiPAM, FortiProxy, and FortiSwitchManager. With a CVSS score of 5.4, it's not the flashiest vulnerability on paper, but in the hands of a competent attacker it enables arbitrary file writes and deletes via crafted command arguments. Fortinet patched it in April 2026.
Unit 42 researchers Daniel Gott and Shawn Westfall found PEERSTITCH during their investigation of a prolonged intrusion against a telecommunications managed service provider, the initial breach dating back to September 2024. The campaign is tracked as CL-STA-0954, also known as UNC5820.
The entry point was CVE-2024-47575, the FortiManager flaw nicknamed FortiJump. From there, the attackers moved efficiently. They extracted an archive containing running configurations, cryptographic material, and database files covering more than 500 managed FortiGate firewalls. The haul included serial numbers, public IP addresses, internal network topology, routing tables, ciphertext credentials, private keys, and full management relationship maps between the FortiManager appliance and every enrolled device.
That kind of intelligence doesn't sit on a shelf. The attackers used it to conduct reconnaissance, establish long-term access, intercept traffic, set up unauthorised SSL/VPN sessions to perimeter firewalls, plant backdoors, and ultimately deploy PEERSTITCH via the privilege escalation flaw.
So what exactly is PEERSTITCH? It's a 64-bit Linux ARM64 binary written in C. The initial foothold is an auto-script that pulls five components from an external server: an environment prep script that deletes itself after running, an Emscripten JavaScript runtime module, a compiled WebAssembly binary, a deployment orchestrator, and the core injector binary.
After a deliberate execution delay, the orchestrator launches the injector, which targets two legitimate FortiOS daemons: miglogd and iked. It locates the running processes, maps their memory layout, attaches using ptrace, halts execution, allocates executable memory, writes malicious code into it, and redirects execution flow through the injected code.
The result is a covert inter-process communication bridge that sits entirely inside process memory, using legitimate daemons as cover. No listening ports. No outbound connections. No binary on disk. As Unit 42 put it, PEERSTITCH communicates through traffic generated by processes the host was already running.
The specifics of how it manipulates VPN handling are particularly clever. The hook in miglogd watches for two markers embedded in passing traffic: TCP port 8550 and IP address 169.254.0.1. When those patterns appear, it passes a session token to iked. The iked hook then looks for that token during subsequent VPN session handling, and if it finds one, it routes that session down an alternative execution path that skips FortiOS's default security validations. Effectively, certain VPN sessions get waved through a back door the attacker has quietly propped open inside the daemon.
Separately, the attackers also set up a command-and-control channel by abusing Apache's native mod_md module on FortiGate firewalls to spawn an SSH reverse shell. They also impersonated the FortiManager platform to pull data from managed firewalls across the target network.
Unit 42 noted that the attackers showed detailed familiarity with Fortinet's appliance architecture and internal management protocols. CVE-2024-26009 and CVE-2024-26008 may have played a role in some of the lateral movement, though the researchers noted those vulnerabilities require FortiGate Cloud or FortiCloud SSO enrollment, which the affected firewalls lacked.
The group also took active steps to cover their tracks: terminating syslog generation, clearing crash logs, disrupting logging telemetry, and automatically deleting rogue administrator accounts and auto-script objects post-execution.
The broader point here is uncomfortable. Centralised edge management platforms like FortiManager are attractive targets precisely because compromising one gives you a map to everything downstream. PEERSTITCH is a reminder that attackers targeting network edge devices are getting better at this, building malware that is invisible to conventional monitoring, persistent without leaving traces, and deeply embedded in the legitimate processes defenders would least want to interfere with.