PEERSTITCH Malware Exploited Fortinet Management to Compromise 500+ Firewalls

Overview

• Unit 42 says the operation began with a FortiManager breach that let attackers steal running configs, certificates, keys and an inventory for more than 500 FortiGate devices in September 2024.
• Those stolen artifacts let the attackers set up unauthorized SSL/VPN sessions and impersonate the management platform to reach downstream firewalls.
• The actors then used a FortiOS privilege‑escalation (CVE-2025-61624), patched by Fortinet in April 2026, to deploy PEERSTITCH, a previously unreported memory‑resident ARM64 implant.
• PEERSTITCH avoids files and listening ports by injecting code into FortiOS daemons (/bin/miglogd and /bin/iked) with a native ARM64 injector that uses ptrace and embedded markers (TCP port 8550 and IP 169.254.0.1) to alter VPN session handling and bypass checks.
• Defenders face hard recovery work because the implant leaves no disk artifacts, hides in live process memory, and the stolen cryptographic trust material remains valid until keys and certificates are individually rotated, raising wider risks for managed service providers and their clients.