PEERSTITCH Implant Hijacks FortiGate Processes via FortiManager Breach
Attackers used a missing-auth flaw and path traversal to deploy memory-resident malware on FortiGate firewalls, stealing configs and credentials.
Key points
- PEERSTITCH is a memory-resident ARM64 implant that hijacks legitimate FortiOS processes without creating files or ports.
- Initial access used CVE-2024-47575 (FortiJump) to compromise a FortiManager, exposing data for over 500 firewalls.
- Attackers escalated privileges using CVE-2025-61624 to execute the loader with root-level operating-system privileges.
The intruders gained persistent, stealthy access to FortiGate firewalls by deploying PEERSTITCH, an implant that resides entirely in system memory. This technique allowed the attackers, tracked as CL-STA-0954 or UNC5820, to hijack legitimate FortiOS processes without leaving persistent executables, opening listening ports, or initiating outbound connections. According to GBHackers, this deployment targeted a telecommunications managed service provider during a prolonged intrusion.
How it unfolded
- In September 2024, attackers exploited CVE-2024-47575, a missing-authentication vulnerability known as FortiJump, to breach a centralized FortiManager appliance.
- They abused the management channel on TCP port 541 to register a rogue virtual appliance named localhost, then exfiltrated a .tm configuration archive containing encrypted credentials and keys.
- Using stolen credentials, they established unauthorized VPN sessions and pushed packet-capture configurations to intercept HTTP traffic and monitor authentication services.
- Finally, they deployed PEERSTITCH by exploiting CVE-2025-61624, a privileged path-traversal flaw, to execute a loader that injected code into logging and IKE processes.
Who is affected
The intrusion compromised a single telecommunications managed service provider, according to the investigation published October 14. Unit 42 confirmed that the breach of the central FortiManager exposed configurations and cryptographic material tied to more than 500 managed firewalls. While researchers did not investigate customer networks or confirm downstream compromises, they noted that administrative and SSL/VPN passwords were recoverable from the stolen configuration data.
The fix
The source material does not confirm that a patch or update has been released for CVE-2024-47575 or CVE-2025-61624. Managed service providers should monitor Fortinet advisories closely for remediation guidance. Until vendors provide confirmed fixes, teams must assume that systems with these vulnerabilities remain at risk if they are reachable by attackers.
What made it possible
This incident illustrates the danger of privilege escalation in network management platforms. Attackers often exploit missing authentication to gain initial footholds, then leverage path-traversal flaws to execute code with elevated rights. For MSPs, this highlights the need to treat centralized management appliances as critical infrastructure. Teams usually segment these systems strictly and monitor for unusual process injections or configuration exports that do not match normal administrative patterns.
Background: Firewalls
A firewall is a network security device that monitors incoming and outgoing traffic. It applies a set of rules to allow or block data packets. This creates a barrier between trusted internal networks and untrusted external ones, stopping unauthorized access before it reaches your servers.
Read the full guide: How Firewalls Work: The Mechanics Behind Network Traffic Control
What to do and how to stay safe: Fortinet
- Audit FortiManager access logs for unauthorized virtual appliance registrations or unusual activity on TCP port 541.
- Review firewall configurations for unexpected packet-capture settings targeting sensitive services like RADIUS or LDAP.
- Rotate all administrative and SSL/VPN credentials for any firewalls managed by the potentially compromised FortiManager.
- Monitor for signs of memory-resident malware by checking for legitimate processes behaving abnormally, such as unexpected resource usage.
Step-by-step guide: Offline Backups: Real Protection Against Ransomware and Data Loss
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is PEERSTITCH?
PEERSTITCH is a memory-resident ARM64 implant that hijacks legitimate FortiOS processes to maintain access without creating files or network connections.
Which vulnerabilities were exploited?
Attackers used CVE-2024-47575 (FortiJump) for initial access and CVE-2025-61624, a path-traversal vulnerability, to escalate privileges and deploy the malware.
How many firewalls were exposed?
The breach of the central FortiManager exposed configurations and cryptographic material for more than 500 managed firewalls.
