A new malware strain called PEERSTITCH has been uncovered exploiting a Fortinet FortiOS vulnerability to conduct sophisticated, stealthy attacks that bypass security checks on tagged VPN sessions.
The Vulnerability & Attack Vector
The exploit hinges on CVE-2025-61624, a path traversal issue embedded in FortiOS’s command-line interpreter components including FortiPAM, FortiProxy, and FortiSwitchManager. This flaw enables a high-privilege adversary to write or delete system files via manipulated command arguments. Fortinet patched the vulnerability in April 2026. Malicious actors, however, leveraged it as part of a broader intrusion campaign known as CL-STA-0954, also called UNC5820, targeting a telecom service provider during September 2024.
Once inside, the attackers made off with a trove of data: device serial numbers, configuration files, ciphered admin credentials, private keys, topology maps, interface configs, and SSL/VPN credentials for over 500 FortiGate firewalls. Such data paved the way for lateral movement, persistent shell access, and deploying PEERSTITCH across critical Fortinet infrastructure.
PEERSTITCH: Function, Delivery, & Stealth
PEERSTITCH is an ARM64 malware with no disk persistence. It leaves no binary files, opens no listening ports, and establishes no outbound connections. Instead, it piggybacks on legitimate system processes for communication, making it difficult for typical endpoint detection and network monitoring tools to spot.
The malware is delivered through a staged payload, including scripts and a WebAssembly (WASM) module. The core binary—named “lldprx”—is an ELF executable that patches memory of two key FortiOS daemons, /bin/miglogd and /bin/iked. After stopping these processes temporarily via ptrace, malicious code is injected that alters execution paths. When traffic contains specific markers—such as TCP port 8550 or the special local IP 169.254.0.1—the infected processes swap to alternate logic paths that dodge standard security checks.
Further evading detection, attackers also used FortiGate’s native Apache module “mod_md” to run reverse-shell command-and-control channels and copied managed firewall configurations by impersonating FortiManager servers. They likely tapped into other vulnerabilities as well—though exploitation of some requires enrollment in specific Fortinet cloud services, which the impacted systems did not use.
Operational Tactics & Coverage
CL-STA-0954 didn’t just steal data: it cleaned up after itself. The intrusion silenced telemetry, terminated syslog generation, purged crash logs, disabled admin accounts created for the operation, and automatically deleted execution scripts once tasks completed. This kind of artifact removal reflects deep knowledge of Fortinet’s architecture and system internals.
Security researchers say this attack underscores a shift: attackers now weaponize centralized edge management tools, turning them into springboards for infecting downstream networks. The PEERSTITCH implant marks a step up in malware craft — evading detection by operating in memory and using covert inter-process communication rather than conventional network or file operations.
What makes PEERSTITCH especially dangerous is its ability to alter behaviour only when certain markers are present—allowing tagged VPN sessions to bypass security controls silently. This is a major escalation in how threat actors are avoiding protective barriers.
Organizations using FortiOS, especially those that manage firewalls via FortiManager or related appliances, should ensure their devices have been patched for CVE-2025-61624. They should also monitor for unusual memory-patching activity in core system daemons, malformed or patterned traffic on ports like 8550, and markers of process hooking that could signal an in-memory implant.
To keep ahead, firms must scrutinize not just the perimeter but also the software managing network edges — and assume that adversaries are capable of complex memory-resident implants that don’t leave obvious traces.
