PEERSTITCH Malware Exploits FortiOS Flaw to Hide in VPN Traffic

According to Palo Alto Networks Unit 42, a suspected advanced threat actor exploited a FortiOS command-line interpreter flaw (CVE-2025-61624) to deploy a new memory-resident ARM64 malware called PEERSTITCH. The attack targeted a telecommunications managed service provider in September 2024, after initial access was gained through the FortiJump vulnerability (CVE-2024-47575) in FortiManager.

The malware leaves no persistent binary on disk, opens no listening ports, and makes no outbound connections. Instead, it injects code into two legitimate FortiOS daemons—miglogd and iked—using ptrace. The injected hooks recognize specific markers in traffic (TCP port 8550 and IP address 169.254.0.1) and alter how VPN sessions are handled, allowing tagged sessions to bypass FortiOS security validations.

Before deploying PEERSTITCH, the attackers exfiltrated extensive data from the FortiManager appliance, including configurations for more than 500 FortiGate firewalls, cryptographic material, and credentials. They also used a separate C2 channel via Apache mod_md to spawn reverse shells and impersonated the FortiManager platform to pull from other managed firewalls. Unit 42 noted the attackers took steps to erase forensic artifacts, such as clearing logs and deleting rogue admin accounts.