PEERSTITCH: how an attack hides inside a FortiOS firewall
by Claudiu Hulea · IT Management Consultant
Most detection tools look for three things: a suspicious file on disk, an open port that should not be there, a connection to an unknown server. PEERSTITCH does none of them. It is one of the cleanest recent examples of how an attack can hide, and where it hides matters as much as the technique: inside a firewall.
According to Unit 42 (Palo Alto Networks) researchers, cited by The Hacker News, the malware was used by a group tracked as CL-STA-0954 (also known as UNC5820), in a prolonged intrusion at a telecommunications managed service provider.
What PEERSTITCH does, concretely
PEERSTITCH is a Linux ARM64 binary, written in C, that runs only in memory. The researchers describe it by what it does not do: it leaves no persistent file on disk, opens no listening ports and initiates no outbound connections. Instead, it communicates through traffic generated by legitimate processes on the device.
The mechanism is elegant in its dangerous way. An injector attaches, through ptrace, to two core FortiOS daemons: miglogd, the process that handles logging, and iked, the one that manages the VPN. It halts their execution, allocates executable memory, writes the malicious code there and redirects execution through it. The result is a hidden channel between two processes that run anyway, legitimately, on any firewall.
The communication uses markers hidden in the data passing through the process (a TCP port, 8550, embedded in the traffic, not an open port, and the link-local address 169.254.0.1, used only for pattern matching). When miglogd recognizes the pattern, it passes an identifier to iked. And iked, on a VPN session marked that way, takes an alternative path that bypasses the default FortiOS security validations.
The irony is worth underlining: the attack hides precisely in the logging daemon.
Hidden afterwards, too
Beyond PEERSTITCH, the attackers used the native Apache mod_md module on the firewall to open an SSH reverse shell, as a second control channel. They impersonated the FortiManager platform to pull data from other managed firewalls on the network.
And they erased their tracks methodically: they stopped syslog generation, cleared crash logs, disrupted logging telemetry and scheduled the automatic deletion of the administrator accounts they had created and of the scripts they had used, right after execution.
An attack that leaves no files, makes no connections of its own and switches off its own logs is an attack you will not find by looking in the usual places.
The chain: from the management console to the firewall
The vulnerability used to install PEERSTITCH is CVE-2025-61624 (CVSS 5.4), a path traversal in the FortiOS command line interpreter that lets an already-privileged attacker write or delete files. It affects FortiOS, FortiPAM, FortiProxy and FortiSwitchManager and was fixed by Fortinet in April 2026 (FG-IR-26-122).
Initial access came separately, through CVE-2024-47575, the critical FortiManager vulnerability known as FortiJump. From the management console, the attackers extracted the configurations of more than 500 managed firewalls, together with encrypted credentials, private keys and the network map. With that, they went further.
Two lessons come straight out of this:
- a moderate CVSS does not mean moderate risk. 5.4 reflects the fact that exploitation requires privileges. But in a chain, the very vulnerability that turns access into hidden persistence is the one that matters most;
- the management console is the crown jewel. A single compromised FortiManager meant the configurations and keys for hundreds of firewalls.
What it means for defense
Edge devices (firewalls, VPN gateways, management consoles) are a classic blind spot: they do not run EDR, they are monitored less closely than servers, and they are treated as infrastructure, not as systems that can be compromised. PEERSTITCH exploits exactly that.
- Apply the patches for FortiOS (CVE-2025-61624) and FortiManager (CVE-2024-47575), on every affected product.
- Protect and segment the management console. It must not be reachable from anywhere, and access to it must be strongly authenticated and audited.
- Send logs to an external SIEM, in advance. If the attacker can switch off syslog on the device, the only reliable trace is the one that has already left it. It is the same lesson as with the NetScaler compromises.
- Treat silent logs as an alarm. A device that suddenly stops sending logs is not “quiet”, it is a signal.
- If you suspect compromise, rotate everything: administrative and VPN credentials, and the private keys that lived in the configurations.
What to look for
The published indicators include the download server 23.240.77[.]233:8085 and the components of the installation chain: pM.js (a self-deleting preparation script), index.js, index.wasm, ipssem.js (the orchestrator) and lldprx (the injector, the PEERSTITCH core). For the full list, with hashes, see the Unit 42 report and the Fortinet advisory. And remember: malware that lives only in memory and wipes its tracks is not found with a file search. It is found through what is missing (stopped logs, interrupted telemetry) and through comparison with a known-good state.
What we take away
PEERSTITCH shows that a sophisticated attack does not need to make noise. No files, no ports, no connections of its own, hidden in the processes the firewall runs anyway, and with its logs switched off by the attacker. Defense can no longer assume that an edge device will report its own compromise. You have to watch it from the outside, with logs that have already left it.
Want an assessment of how the edge devices and management consoles on your network are monitored? Contact us and we start from an exposure analysis.
Sources
Frequently asked questions
What is PEERSTITCH?
A new malware, documented by Unit 42 (Palo Alto Networks) researchers, that runs only in memory on FortiOS devices (a Linux ARM64 binary). It leaves no persistent file on disk, opens no ports and makes no connections of its own. It injects itself into the legitimate miglogd and iked daemons and communicates through the traffic they generate anyway.
Which vulnerability was used?
CVE-2025-61624 (CVSS 5.4), a path traversal in the FortiOS command line interpreter that lets an already-privileged attacker write or delete files. It affects FortiOS, FortiPAM, FortiProxy and FortiSwitchManager and was fixed by Fortinet in April 2026 (FG-IR-26-122). Initial access came separately, through the FortiManager vulnerability CVE-2024-47575, known as FortiJump.
Why is a CVSS of 5.4 still serious?
The score is moderate because exploitation requires an attacker who already has privileges. But in an attack chain, exactly that kind of vulnerability turns an obtained foothold into persistence that is hard to detect. The score of an isolated vulnerability does not tell you how much it matters in the chain it is used in.
How do I defend myself?
Apply the FortiOS and FortiManager patches, protect and segment the management console, send the logs of edge devices to an external SIEM in advance, and treat a sudden stop in logging as an alarm. If you suspect compromise, rotate the credentials and keys that live in the configurations.
