An advanced cyber threat has been observed targeting vulnerabilities in Fortinet’s FortiOS to distribute a previously undetected ARM64 malware named PEERSTITCH. This sophisticated attack leverages a path traversal flaw, identified as CVE-2025-61624, which was patched in April 2026. The flaw affects FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, allowing attackers to manipulate files through crafted command arguments.
Details of the PEERSTITCH Malware
PEERSTITCH is notable for its stealthy operation, leaving no binary traces on disk and avoiding direct network communications. Instead, it exploits legitimate traffic processes, making it challenging to detect with standard endpoint and network security measures. Researchers at Palo Alto Networks Unit 42 uncovered this activity during an investigation into a compromised telecommunications service provider in September 2024, tracking it as CL-STA-0954 or UNC5820.
The attackers initially gained access through a critical Fortinet FortiManager vulnerability, FortiJump (CVE-2024-47575), and subsequently exfiltrated sensitive data from over 500 FortiGate firewalls. This data included configuration files, network maps, and cryptographic material, which were then used to further infiltrate and maintain access to the network infrastructure.
Technical Mechanisms and Exploitation
The PEERSTITCH malware is a 64-bit Linux ARM64 executable, orchestrated through a series of scripts that download components from an external server. The attack initiates with the ipssem.js script, which runs the lldprx injector targeting FortiOS daemons. By modifying process memory, the malware creates a covert communication bridge, bypassing conventional security checks.
Key markers within the data, such as a TCP port and an IP address, enable the malware to manipulate VPN session handling by FortiOS, allowing it to bypass security validations. This manipulation effectively alters how the VPN daemon processes certain sessions, evading detection.
Broader Implications and Future Threats
Beyond deploying PEERSTITCH, the attackers established a secondary command-and-control channel using the Apache “mod_md” module to execute an SSH-based reverse shell. They demonstrated deep understanding of Fortinet’s architecture and management protocols, raising concerns about potential exploitation of other vulnerabilities.
Unit 42 highlighted the attackers’ efforts to erase forensic evidence, such as disabling syslog, clearing crash logs, and removing unauthorized admin accounts. This intrusion exemplifies a significant threat from actors weaponizing centralized management systems to infiltrate networks downstream.
The discovery of the PEERSTITCH implant underscores the growing sophistication of edge-device malware. By avoiding persistent disk artifacts and establishing covert inter-process communication, the threat actors achieved sustained stealth and persistence, posing a challenge to traditional monitoring methods.
