Cybersecurity
FortiOS flaw used to deploy PEERSTITCH malware
Palo Alto Networks’ Unit 42 said a group tracked as CL-STA-0954 used Fortinet management flaws and stolen appliance data to install PEERSTITCH, a memory-resident ARM64 implant that altered VPN session checks.
- Palo Alto Networks’ Unit 42 said it found the activity during a September 2024 intrusion at a telecommunications managed service provider.
- Unit 42 said the intrusion, also tracked as UNC5820, began with exploitation of a FortiManager flaw called FortiJump.
- The attackers were said to have taken configuration files, cryptographic material and database data covering more than 500 managed FortiGate firewalls.
- Unit 42 said the stolen material was then used for reconnaissance, persistent access, traffic interception and deployment of PEERSTITCH through CVE-2025-61624, which Fortinet patched in April 2026.
Palo Alto Networks’ Unit 42 said it found the activity during a September 2024 intrusion at a telecommunications managed service provider. It tracked the operation as CL-STA-0954, also known as UNC5820, and said the first access came through a FortiManager flaw called FortiJump.
According to the researchers, the attackers took archives containing running configurations, keys and database files for more than 500 managed FortiGate firewalls. Unit 42 said that information was then used for reconnaissance, long-term access, traffic interception and unauthorised SSL/VPN sessions.
The researchers said PEERSTITCH was a 64-bit Linux ARM64 implant written in C. They said it fetched five files from a server at 23.240.77.233:8085, including scripts, a WebAssembly component and a native injector.
Unit 42 said the injector attached to /bin/miglogd and /bin/iked, examined their memory maps and altered execution inside those processes. It said the code changed how selected VPN sessions were handled when it found specific markers in the data path.
The company also said the attackers used Apache’s mod_md module on FortiGate devices to start an SSH reverse shell and removed forensic traces by stopping logs and deleting rogue accounts and scripts. It added that some other flaws were suspected, but said those would have required FortiGate Cloud or FortiCloud SSO enrolment, which the affected firewalls did not have.
Named in this story
People
- Daniel Gott
- one of the Unit 42 researchers quoted
- Shawn Westfall
- one of the Unit 42 researchers quoted
Companies
- Fortinet
- supplied and patched the affected products
- Palo Alto Networks
- the company behind Unit 42
Organisations
- Unit 42
- the security team that investigated the intrusion
- CL-STA-0954
- Unit 42’s tracking label for the intrusion
Products and systems
- FortiOS
- the operating system whose flaw was used for the final implant
- FortiPAM
- one of the Fortinet products named in the flaw
- FortiProxy
- one of the Fortinet products named in the flaw
- FortiSwitchManager
- one of the Fortinet products named in the flaw
- FortiManager
- the appliance whose compromise gave initial access and data
- FortiGate
- the firewalls whose details were stolen and whose sessions were targeted
- PEERSTITCH
- the malware implant delivered in the attack
- miglogd
- a FortiOS daemon altered by the implant
- iked
- a FortiOS VPN daemon altered by the implant
- Apache mod_md
- the Apache module used to spawn an SSH reverse shell
How the source tells it
The piece was mostly a technical incident report, but the researchers’ own wording added a restrained threat frame around stealth, persistence and attacker skill.
- threat inflation the researchers’ evaluative language cast the intrusion as a growing threat and proof of rising technical maturity
- urgency the reporting repeatedly stressed covert access, persistence and evasion of monitoring