PEERSTITCH malware used FortiOS flaw to bypass tagged VPN checks

A previously unreported memory-resident malware implant called PEERSTITCH has been observed in a long-running intrusion involving Fortinet edge infrastructure. The malware was delivered after attackers exploited a FortiOS path-traversal flaw, then used process-memory injection to alter how VPN sessions were handled.¹

Unit 42, the Palo Alto Networks threat-research team that investigated the activity, says the intrusion began with the compromise of a FortiManager appliance in September 2024. The attackers allegedly extracted configurations, cryptographic material and database files containing information about more than 500 managed FortiGate firewalls, including serial numbers, public IP addresses, network maps and VPN credentials.¹

The later-stage implant is linked to CVE-2025-61624, a vulnerability in the command-line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. Fortinet’s advisory describes the issue as a path-traversal flaw that could let a privileged attacker write or delete files through crafted arguments to existing commands. The vulnerability was patched by Fortinet in April 2026.²

PEERSTITCH is designed to avoid the usual signs of a persistent malware installation. Unit 42 says it leaves no persistent binary on disk, opens no listening port and makes no direct outbound network connection. Instead, an injector targets the legitimate FortiOS processes `miglogd` and `iked`, using `ptrace` to place code into their memory and redirect execution.¹

The injected hooks recognise traffic markers associated with port 8550 and the link-local address 169.254.0.1. A token passed through one process can then be recognised by the VPN daemon, allowing a tagged session to bypass normal FortiOS security checks. The attackers also used the native Apache `mod_md` module to create an SSH-based reverse shell, according to Unit 42.¹

The research describes the wider activity as CL-STA-0954, also known as UNC5820. Although Unit 42 cannot definitively attribute every suspected vulnerability used in the operation, it says the attackers showed detailed knowledge of Fortinet appliance architecture, FortiOS internals and FortiGate management protocols.¹

Our opinion

PEERSTITCH matters less because it is a flashy new file and more because it turns trusted edge processes into camouflage. A conventional scanner looking for a new binary, listening port or obvious command-and-control connection could miss an implant that lives inside legitimate daemons and communicates through their normal traffic. Organisations running affected Fortinet products should treat the advisory and vendor patch guidance as the starting point, while reviewing central-management access, VPN sessions, configuration archives and logging for signs of tampering. The research is also a reminder that one compromised management appliance can expose far more than its own settings.