Severity
High
Analysis Summary
A suspected advanced threat actor has exploited a Fortinet FortiOS vulnerability to deploy PEERSTITCH, a previously undocumented, memory-resident ARM64 malware designed to evade conventional security detection.
The attack exploits CVE-2025-61624 (CVSS 5.4), a path traversal vulnerability affecting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. The flaw allows a privileged attacker to write or delete arbitrary files through specially crafted command arguments. Fortinet patched the vulnerability in April 2026.
Security firm discovered the activity during an investigation into a prolonged intrusion targeting a telecommunications managed service provider in September 2024. Tracked as CL-STA-0954 (also known as UNC5820), the campaign initially exploited the critical FortiManager FortiJump vulnerability (CVE-2024-47575) to gain access to the appliance.
Following the compromise, attackers exfiltrated sensitive information associated with more than 500 managed FortiGate firewalls. The stolen data included firewall configurations, serial numbers, public IP addresses, network topology maps, routing tables, administrative and VPN credentials, certificates, and cryptographic material. This information enabled network reconnaissance, long-term access, traffic interception, unauthorized SSL/VPN sessions, and backdoor deployment.
PEERSTITCH is a 64-bit Linux ARM64 executable written in C. It uses an automated script to download five components, including JavaScript orchestration modules, a WebAssembly binary, and a native ARM64 injector. The injector targets two legitimate FortiOS processes, /bin/miglogd and /bin/iked, using ptrace to manipulate their memory and execute malicious code.
The malware establishes a covert, memory-resident communication bridge between these processes. It identifies specific traffic patterns containing port marker 8550 and IP address 169.254.0.1, then transfers session identifiers between the processes to alter VPN session handling and bypass default security validations. PEERSTITCH leaves no persistent binary on disk, opens no listening ports, and initiates no outbound network connections.
Separately, attackers leveraged Apache's native mod_md module to establish an SSH-based reverse shell and impersonated FortiManager to retrieve information from additional managed firewalls.
The campaign also involved extensive anti-forensic measures, including terminating syslog generation, clearing crash logs, disrupting telemetry, and automatically deleting rogue administrator accounts and deployment scripts.
Researchers warns that the incident demonstrates the growing sophistication of attacks against centralized edge-management infrastructure, highlighting the risks posed by compromised management appliances and the downstream networks they control.
Impact
- Unauthorized Access
- Sensitive Information Exposure
- Lateral Movement
- Credential Theft
Indicators of Compromise
IP
23.240.77.233
47.18.167.159
45.32.41.202
198.199.122.22
MD5
- daa2440422ebe714f4fe5101b5d33a3b
SHA-256
- b7ae166fd49a7ecfe6322a80b8aa56d6aa0825d8f5d106dab2e4fb7d14ce15a8
SHA1
- 0b9a9524b1a725a4ec7d3318742147cbac110dc0
URL
- http://23.240.77.233:8085/pM.js
- http://47.18.167.159:8085/pM.js
- http://23.240.77.233:8084/directory
- http://23.240.77.233:8084/acme/new-acct
- http://23.240.77.233:8084/acme/order/11111
- http://23.240.77.233:8084/acme/authz/1
- http://23.240.77.233:8084/acme/finalize/61924744/774083503
Remediation
- Update affected Fortinet products to the latest patched versions to remediate CVE-2025-61624 and prevent exploitation.
- Monitor FortiGate and FortiManager logs for suspicious administrative activity, unauthorized configuration changes, and abnormal VPN sessions.
- Hunt for PEERSTITCH indicators, including traffic patterns containing port marker 8550 and IP address 169.254.0.1.
- Inspect FortiOS processes miglogd and iked for anomalous behavior indicative of process injection or memory manipulation.
- Investigate suspicious connections to 23.240.77[.]233:8085 and identify potential malware delivery or command-and-control activity.
- Review firewall configurations, administrator accounts, VPN credentials, certificates, and cryptographic keys for potential compromise; rotate exposed credentials and secrets.
- Monitor for unauthorized SSH reverse shells, suspicious use of Apache mod_md, and unexpected inter-process communication.
- Verify logging and telemetry integrity, and investigate missing syslog records, cleared crash logs, or other signs of anti-forensic activity.
- Audit FortiManager-to-FortiGate management relationships for unauthorized access, suspicious configuration retrieval, and potential downstream network compromise.
- If compromise is detected, initiate incident response procedures, preserve forensic evidence, and isolate affected appliances where operationally feasible.