Check FortiGate Logs for PEERSTITCH Memory Implant Activity
Attackers used FortiJump and path-traversal flaws to install a fileless ARM64 implant on FortiGate firewalls, hiding in system memory.
Key points
- PEERSTITCH is a memory-resident ARM64 implant targeting FortiGate firewalls.
- Attackers exploited CVE-2024-47575 and CVE-2025-61624 during the intrusion.
- The malware hijacks legitimate processes without creating persistent files or ports.
Security teams should verify FortiGate configurations for signs of PEERSTITCH implantation, a memory-resident threat that operates without leaving executable files or opening network ports. This ARM64 malware targets FortiGate firewalls by hijacking legitimate system processes, making traditional file-based detection methods ineffective.
The risk
The intrusion began in September 2024 when attackers exploited CVE-2024-47575, known as FortiJump, a missing-authentication vulnerability in a centralized FortiManager appliance. According to Unit 42, this initial breach exposed configurations and cryptographic material tied to more than 500 managed firewalls. Attackers used the stolen data to establish unauthorized VPN sessions and push packet-capture rules to target HTTP, TFTP, RADIUS, and LDAP traffic.
Who is exposed
Organizations using FortiManager to centrally manage FortiGate firewalls face significant exposure if they did not patch CVE-2024-47575 promptly. The attackers abused the management channel on TCP port 541 to register a rogue virtual appliance named localhost. They subsequently exfiltrated a configuration archive containing running configurations, administrative databases, network topology, encrypted credentials, certificates, and private keys.
Cost and compliance
Unit 42 confirmed that administrative and SSL/VPN passwords were recoverable from the stolen configuration archives. The attackers used these legitimate credentials to maintain access from infrastructure including IP addresses 23.240.77[.]233 and 47.18.167[.]159. No fix has been confirmed for the specific deployment method involving CVE-2025-61624 in the source material, though the vulnerability itself is documented.
Our take on the response
The use of CVE-2025-61624, a privileged path-traversal flaw in the Fortinet command-line interpreter, allowed attackers to execute a loader with root-level privileges. This crossed the boundary between restricted administration and full process control. Teams must assume that compromised management consoles can lead to widespread firewall configuration changes and credential theft.
What defenders should look for
Defenders should monitor for unusual process behavior in FortiOS, such as legitimate processes like miglogd or iked exhibiting unexpected resource usage or memory modifications. Check for unauthorized packet-capture configurations or sudden changes to VPN session logs. Look for connections to unknown external IP addresses from management interfaces. Verify that no rogue virtual appliances have been registered in the management console.
What to do and how to stay safe: PEERSTITCH
- Review FortiGate system logs for unauthorized packet-capture rules or unexpected VPN sessions initiated from management interfaces.
- Audit all registered virtual appliances and management console configurations for rogue entries or unauthorized serial numbers.
- Rotate all administrative credentials and SSL/VPN passwords immediately if FortiManager or FortiGate configurations were accessed by unauthorized users.
- Monitor network traffic for anomalies related to TFTP, RADIUS, and LDAP services that could indicate credential interception attempts.
Step-by-step guide: Ransomware Myths Debunked: The Hidden Truths About Encryption Attacks
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is PEERSTITCH malware?
PEERSTITCH is a memory-resident ARM64 implant that targets FortiGate firewalls by hijacking legitimate processes without creating persistent files or opening ports.
Which vulnerabilities did attackers use?
Attackers exploited CVE-2024-47575 (FortiJump) for initial access and CVE-2025-61624, a path-traversal vulnerability, for privilege escalation and deployment.
How did attackers hide their activity?
The malware hid in system memory, deleted its executable after installation, and did not open listening ports or initiate outbound connections on its own.
