PEERSTITCH Malware Uses FortiOS Flaw to Alter Tagged VPN Sessions
Summary
Unit 42 reports that attackers exploited FortiOS CVE-2025-61624 to deploy PEERSTITCH, a memory-resident implant that injects code into FortiOS daemons and alters handling of tagged VPN sessions.
Key points
- Unit 42 attributed the activity to CL-STA-0954, also known as UNC5820, and linked it to an intrusion involving a telecommunications managed service provider.
- The attackers reportedly used CVE-2025-61624, a FortiOS command-line path traversal flaw, to deploy PEERSTITCH; Fortinet patched the flaw in April 2026.
- PEERSTITCH is a memory-resident ARM64 Linux executable that does not leave a persistent binary on disk or initiate its own outbound network connections.
- An injector patches the memory of FortiOS daemons miglogd and iked, creating a covert communication bridge between the processes.
- The hooks pass a session identifier between the daemons and can redirect handling of matching VPN sessions around default FortiOS security validations.
- Researchers also observed a separate SSH reverse-shell channel using Apache mod_md, and reported that attackers disrupted logging and removed forensic artifacts.
Article Details
- Attack Vectors
- The attackers exploited CVE-2025-61624, a FortiOS command-line interpreter path traversal flaw, to write or delete files and deploy PEERSTITCH.
- The intrusion initially compromised FortiManager by exploiting CVE-2024-47575 (FortiJump), then used stolen firewall configurations and credentials or other harvested information for reconnaissance and access to downstream networks.
- PEERSTITCH's components were configured to download from an external server. Its injector used ptrace to patch the memory of the FortiOS processes miglogd and iked, creating a covert communication bridge and altering handling of tagged VPN sessions.
- The attackers established a separate command-and-control channel by using Apache mod_md on FortiGate firewalls to spawn an SSH-based reverse shell.
- The attackers impersonated FortiManager to pull information from managed firewalls. Unit 42 said exploitation of CVE-2024-26009 and CVE-2024-26008 was suspected but not definitive; it also noted that exploiting those flaws requires FortiGate Cloud/FortiCloud SSO enrollment, which the affected firewalls did not have.
- Defensive Notes
- Fortinet patched CVE-2025-61624 in April 2026; apply the relevant vendor security updates to affected products.
- Monitor FortiOS appliances and processes for unexpected memory manipulation or ptrace activity involving miglogd and iked, unusual tagged VPN sessions, and unauthorized changes to VPN-session handling.
- Investigate unexpected SSH-based reverse shells, unauthorized FortiGate SSL/VPN sessions, and suspicious use of Apache mod_md on FortiGate firewalls.
- Check for interference with syslog generation or logging telemetry, cleared crash logs, and unexpected deletion of administrator accounts or auto-script objects.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 23[.]240[.]77[.]233 | External server identified as the source from which PEERSTITCH's auto-script downloads five components. |
MITRE ATT&CK
T1021.004 · SSHThe attackers used an SSH-based reverse shell as a separate command-and-control channel.T1055.008 · Ptrace System CallsThe lldprx injector used ptrace to attach to miglogd and iked, allocate executable memory, write malicious code, and redirect execution.T1070.002 · Clear Linux or Mac System LogsThe attackers cleared crash logs and removed forensic artifacts.T1105 · Ingress Tool TransferPEERSTITCH's auto-script was designed to download five components from an external server.T1190 · Exploit Public-Facing ApplicationThe attackers exploited Fortinet appliance vulnerabilities, including CVE-2025-61624 and CVE-2024-47575, to gain access.T1562.001 · Disable or Modify ToolsThe attackers terminated syslog generation and disrupted logging telemetry.
CVE
CVE-2024-26008definitive, it's suspected that the attackers may have exploited other flaws like CVE-2024-26009 and CVE-2024-26008 to carry out this task. However, Unit 42 emphasized that exploiting these vulnerabilities requiresCVE-2024-26009Although not definitive, it's suspected that the attackers may have exploited other flaws like CVE-2024-26009 and CVE-2024-26008 to carry out this task. However, Unit 42 emphasized that exploiting these vulnerabilitiesCVE-2024-47575with initial access obtained by exploiting a critical Fortinet FortiManager flaw dubbed FortiJump (CVE-2024-47575).CVE-2025-61624The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a privileged
People
Threat Actors
Malware
Vendors
Products
FortiManagertracked as CL-STA-0954 (aka UNC5820), with initial access obtained by exploiting a critical Fortinet FortiManager flaw dubbed FortiJump (CVE-2024-47575).Fortinet FortiGatecryptographic material, and database files containing information about more than 500 managed FortiGate firewalls. Some of the harvested details are listed below -FortiOSA suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH.FortiPAMof CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a privileged attacker to achieve arbitrary write orFortiProxy(CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a privileged attacker to achieve arbitrary write or deleteFortiSwitchManager5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a privileged attacker to achieve arbitrary write or delete files via specifically