PEERSTITCH: A Stealthy Malware Hiding Inside Fortinet Firewalls
Firewalls and VPN gateways sit at the edge of a network, so a compromise there can give an attacker a view of everything behind it. Researchers at Palo Alto Networks Unit 42 have now described a malware implant that takes advantage of exactly that position, and that was built to leave almost no trace.
What was discovered
Unit 42 detailed a previously unreported malware called PEERSTITCH, a memory-resident implant for 64-bit ARM Linux that runs on Fortinet’s FortiOS. According to the researchers, it leaves no persistent binary on disk, opens no listening ports and makes no outbound connections of its own. It communicates through traffic generated by legitimate processes on the infected device, which makes it resistant to conventional endpoint and network detection.
How the attack unfolded
Unit 42 found the malware while investigating a long-running intrusion at a telecommunications managed service provider, which began in September 2024. The attackers, tracked as CL-STA-0954 (also known as UNC5820), got in by exploiting a critical FortiManager flaw nicknamed FortiJump (CVE-2024-47575). Once inside, they took a rich haul of data from the management appliance: configuration files for more than 500 managed FortiGate firewalls, a device inventory with serial numbers and public IP addresses, network topology and routing details, encrypted administrator and VPN credentials, and cryptographic certificates and private keys.
With that information, the attackers mapped the network, set up unauthorized VPN sessions to perimeter firewalls, planted backdoors and intercepted traffic. They also exploited a separate privilege-escalation bug, CVE-2025-61624, to deploy PEERSTITCH itself.
The flaw that made it possible
CVE-2025-61624 is a path traversal vulnerability in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. A privileged attacker can use specially crafted command arguments to write or delete arbitrary files. Its severity score is a modest 5.4, which is a good reminder that a “medium” rating does not make a bug harmless, because attackers chain flaws together and a lower-rated one can be the missing step. Fortinet patched it in April 2026, and CISA added it to its Known Exploited Vulnerabilities catalog on October 16, 2026, requiring federal agencies to apply the fix by October 19.
What makes PEERSTITCH so sneaky
After an initial delay, the malware injects code into two legitimate FortiOS processes, one that handles logging and one that handles VPN connections. It then creates a covert communication bridge between them entirely inside memory, using hidden markers in the data passing through the logging process. When the VPN process sees a session carrying that marker, it takes an alternative path that bypasses the normal FortiOS security checks. In other words, the attackers changed how the firewall treats certain VPN sessions without leaving a file behind. They also set up a separate reverse shell using a native FortiGate module and impersonated the management platform to pull data from other firewalls.
Covering their tracks
Unit 42 says the attackers were skilled at removing evidence. They stopped the generation of system logs, cleared crash logs, disrupted logging telemetry and automatically deleted the rogue administrator accounts and scripts they had created once the work was done. The researchers called the intrusion a sign of a growing trend, in which central management tools for edge devices are turned into a way to compromise every network downstream.
What organizations should do
The most direct step is to apply Fortinet’s April 2026 patches for CVE-2025-61624 on all affected products, along with fixes for earlier flaws such as FortiJump. The article does not list other workarounds, but general good practice applies. Limit who can reach management interfaces, restrict and monitor administrator accounts, treat any appliance holding keys for many devices as a top-tier asset, and rotate credentials and certificates if compromise is suspected. Because this malware lives only in memory, defenders should also forward logs off the device, since local logs may be wiped, and watch for unexpected VPN sessions and configuration changes.
Final thoughts
PEERSTITCH shows how mature edge-device malware has become. When the attacker lives in memory, borrows legitimate processes and erases logs, traditional detection struggles, so the best defense is to patch quickly, shrink the exposure of management systems and assume that edge devices are high-value targets.
Comments