FortiOS malware rewires VPN checks inside live processes
FortiOS malware named PEERSTITCH has been found operating entirely in the memory of compromised appliances, where it modifies two legitimate system processes to change how selected virtual private network (VPN) sessions are validated. Palo Alto Networks Unit 42 attributes the operation to a suspected advanced threat actor and says the implant leaves no persistent executable file on disk, opens no listening port and makes no outbound connection of its own.
The attackers deployed PEERSTITCH by exploiting CVE-2025-61624, a path traversal flaw that allows file operations to escape their intended location. The vulnerability affects the command-line interpreter in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. A privileged attacker can use specially constructed arguments to existing commands to write or delete arbitrary files. It has a Common Vulnerability Scoring System (CVSS) rating of 5.4 and was patched by Fortinet in April 2026.
Unit 42 uncovered the malware while investigating a prolonged intrusion at a telecommunications managed service provider in September 2024. The campaign is tracked as CL-STA-0954, also known as UNC5820. Initial access came through CVE-2024-47575, the critical FortiManager vulnerability known as FortiJump. FortiManager is a central platform used to administer multiple FortiGate network appliances, making its compromise relevant to every downstream environment connected to it.
After entering the management appliance, the attackers removed an archive containing running configurations, cryptographic material and databases with information about more than 500 managed FortiGate firewalls. The stolen material included the FortiManager serial number and its relationships with enrolled devices, configurations from more than 500 firewalls, central embedded relational databases, and an inventory pairing more than 500 FortiGate serial numbers with public IP addresses. Internal topology maps, routing tables and interface settings were also taken, along with encrypted administrative, local and SSL/VPN credentials, public certificates and private keys.
Unit 42 says the attackers used this information to map networks, maintain access, intercept traffic and create unauthorized FortiGate SSL/VPN sessions on perimeter appliances. They also deployed backdoors and used CVE-2025-61624 during the privilege escalation and PEERSTITCH deployment sequence. The attackers reportedly impersonated the FortiManager platform when retrieving information from other managed firewalls in the targeted network.
PEERSTITCH is a 64-bit Linux executable written in C for ARM64, the processor architecture used by the affected appliance environment. Its installation begins with an auto-script that downloads five files from 23.240.77[.]233 on port 8085. These are pM.js, a self-deleting environment setup script; a.js, stored as index.js, which provides an Emscripten JavaScript runtime; a.wasm, stored as index.wasm, containing compiled WebAssembly code; b.js, stored as ipssem.js, which coordinates deployment; and dd, stored as lldprx, which is the native ARM64 injector containing the core malware.
Following a delay, ipssem.js starts lldprx. The injector identifies the running /bin/miglogd and /bin/iked processes, examines their memory layouts and attaches through ptrace, a Linux facility that lets one process inspect and control another. It pauses them with PTRACE_INTERRUPT, allocates executable memory, writes malicious code into that space and redirects the processes into the injected instructions. This creates a communication route inside the memory of two trusted FortiOS processes instead of relying on a conventional file or separate network connection.
The injected miglogd code searches passing data for two markers: TCP port value 8550, which is embedded in traffic rather than opened as a listening port, and the link-local IP address 169.254.0.1. When it recognizes the pattern, it transfers the associated session token or identifier to the modified iked process. The iked hook then searches later VPN sessions for that identifier. A matching session is sent through an alternative execution path that bypasses the normal FortiOS security checks. In practical terms, the FortiOS malware selectively changes how tagged VPN sessions are handled while legitimate processes carry its communications.
The attackers created another command and control (C2) route, meaning a channel used to operate a compromised system remotely, by abusing the native Apache mod_md module on FortiGate appliances to start an SSH reverse shell. A reverse shell makes the compromised device initiate a remote control session rather than waiting for an incoming connection. Unit 42 also considered CVE-2024-26009 and CVE-2024-26008 as possible parts of the activity, but could not confirm their use. Exploiting those flaws requires enrollment in FortiGate Cloud/FortiCloud single sign-on, a shared login service, and none of the affected firewalls had that enrollment.
The operation also attempted to destroy evidence by stopping syslog generation, clearing crash records, disrupting logging telemetry and automatically deleting rogue administrator accounts and auto-script objects after use. These measures, combined with memory-only injection and the absence of an independent network connection, reduce the value of checks focused only on files or newly opened ports. Organisations using centrally managed Fortinet appliances should confirm that the April 2026 fix is installed and assess the management platform and downstream devices together rather than treating each firewall as an isolated system. For organisations reviewing the wider IT impact of an edge-appliance compromise, AEU-I offers security-first IT, infrastructure and consulting.