A suspected advanced threat actor has been observed exploiting a security flaw in **Fortinet FortiOS** to deliver a previously unreported memory-resident ARM64 malware known as **PEERSTITCH**. ### Exploiting Fortinet Vulnerabilities The attack involves the exploitation of **CVE-2025-61624** (CVSS score: 5.4), a path traversal flaw in the command-line interpreter of **FortiOS**, **FortiPAM**, **FortiProxy**, and **FortiSwitchManager**. This vulnerability, patched by **Fortinet** in April 2026, could allow a privileged attacker to achieve arbitrary file write or delete operations via specially crafted arguments. Researchers at **Palo Alto Networks Unit 42**, Daniel Gott and Shawn Westfall, noted that "**PEERSTITCH** leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections." Instead, it communicates through legitimate processes, making it highly resistant to conventional endpoint and network detection methods. ### The CL-STA-0954 Intrusion The cybersecurity company discovered this activity during a prolonged network intrusion against a telecommunications managed service provider in September 2024. This multi-stage intrusion, tracked as **CL-STA-0954** (also known as **UNC5820**), initially gained access by exploiting **CVE-2024-47575** (FortiJump), a critical **Fortinet FortiManager** flaw. Following the compromise of the appliance, attackers exfiltrated an archive containing running configurations, cryptographic material, and database files from over 500 managed **FortiGate** firewalls. The stolen data included: * The **FortiManager** appliance's serial number and its management relationships to enrolled devices. * Running configuration files for over 500 managed **FortiGate** firewalls. * Central management SQLite databases. * An inventory of **FortiGate** serial numbers and their public IP addresses. * Internal network topology maps, routing tables, and interface configurations. * Ciphertext administrative, local, and SSL/VPN credentials. * Encoded cryptographic trust material, including public certificates and private keys. ### PEERSTITCH Deployment and Evasion This harvested information was then used for network reconnaissance, establishing long-term access, intercepting network traffic, setting up unauthorized **FortiGate** SSL/VPN sessions, deploying backdoors, and exploiting **CVE-2025-61624** to deploy **PEERSTITCH**. **PEERSTITCH** is a 64-bit Linux ARM64 executable written in C. It downloads five components from an external server ("23.240.77[.]233:8085"): * `pM.js`: An environment preparation script (self-deleting). * `a.js` (saved as `index.js`): An Emscripten JavaScript runtime module. * `a.wasm` (saved as `index.wasm`): A compiled WebAssembly binary module. * `b.js` (saved as `ipssem.js`): A deployment orchestrator script. * `dd` (saved as `lldprx`): A native ARM64 ELF binary injector (the **PEERSTITCH** core).  After an execution delay, the orchestrator (`ipssem.js`) launches `lldprx`, which then acts as a process memory patching injector targeting two core **FortiOS** daemons: `/bin/miglogd` and `/bin/iked`. This involves locating the running processes, enumerating their memory layout, attaching to them using `ptrace`, halting their execution, allocating executable memory, writing malicious code, and redirecting execution. The goal is to create a covert, memory-resident communication bridge between these legitimate **FortiOS** processes, using them to bypass detection. The `miglogd` hook recognizes specific markers (TCP port `8550` and IP address `169.254.0.1`) embedded within traffic data. Once identified, it passes a session token to the `iked` daemon, which then looks for this identifier in subsequent VPN sessions. If found, it takes an alternative execution path, bypassing default **FortiOS** security validations. ### Additional C2 and Forensic Evasion Beyond **PEERSTITCH**, attackers established a separate command-and-control (C2) channel by leveraging the native Apache `mod_md` module on **FortiGate** firewalls to spawn an SSH-based reverse shell. The attackers also impersonated the **FortiManager** platform to pull data from managed firewalls of other hosts within the targeted network, demonstrating deep proficiency in **Fortinet** appliance architecture and **FortiOS** internals. While not definitively confirmed, it's suspected that other flaws like **CVE-2024-26009** and **CVE-2024-26008** might have been exploited. However, **Unit 42** noted that none of the affected firewalls were enrolled in **FortiGate Cloud/FortiCloud SSO**, a prerequisite for these specific vulnerabilities. **CL-STA-0954** also employed extensive forensic artifact removal techniques, including terminating syslog generation, clearing crash logs, disrupting logging telemetry, and automatically deleting rogue administrator accounts and auto-script objects post-execution. **Unit 42** emphasized that this intrusion highlights a growing threat: the weaponization of centralized edge management ecosystems to compromise downstream networks. The discovery of the **PEERSTITCH** implant demonstrates the increasing technical maturity of edge-device malware, achieving sustained persistence and evading traditional monitoring through one-shot injection, avoidance of disk artifacts, and covert inter-process communication.