Skip to content
Hacker Posts

Unit 42 details PEERSTITCH, a memory-only FortiGate implant

Unit 42 says CL-STA-0954 (Mandiant: UNC5820) chained FortiJump and CVE-2025-61624 to deploy PEERSTITCH, a disk-less ARM64 FortiOS implant, against a telecom MSP.

Published 3 min read
cvefortinetthreat-intelunc5820

Palo Alto Networks Unit 42 has detailed PEERSTITCH, a previously unreported, memory-resident implant planted on FortiGate devices after attackers chained two Fortinet flaws. Initial access came through CVE-2024-47575 (FortiJump) against a FortiManager appliance; privilege escalation used CVE-2025-61624, a FortiOS path-traversal flaw, to deploy the implant. Both are patched. If you run FortiManager or FortiOS and haven't applied the April 2026 fixes, do that today — and hunt, because this implant leaves almost nothing on disk.

The primary source is Unit 42's report, Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant. Secondary coverage is at The Hacker News.

The chain

Unit 42 investigated a multi-stage intrusion at a telecommunications managed service provider. The actor first compromised a centralized FortiManager appliance via FortiJump (CVE-2024-47575), then pulled an archive covering 500+ managed FortiGate firewalls — running configurations, cryptographic material and database files. From there it used CVE-2025-61624, a path traversal in the command-line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager that allows crafted arguments to write or delete arbitrary files, to stage PEERSTITCH.

PEERSTITCH is a 64-bit Linux ARM64 in-memory implant written in C. Per Unit 42 it leaves no persistent binary on disk, opens no listening ports and makes no outbound connections — it rides traffic from legitimate FortiOS processes instead, which is what makes network and file-based detection unreliable.

CVSS and patch

Fortinet rates CVE-2025-61624 5.4 and fixed it on April 14, 2026 in advisory FG-IR-26-122. The NVD entry scores it higher, 6.5 — note the discrepancy when you prioritize. CVE-2024-47575 (FortiJump) has been a KEV-listed, actively exploited FortiManager bug since late 2024.

Attribution

Unit 42 tracks the intrusion as CL-STA-0954, which Google's Mandiant tracks as UNC5820. Unit 42 says the post-exploitation tradecraft overlaps with activity attributed to suspected nation-state actors, and The Hacker News characterizes the operator as a "suspected advanced threat actor." No country is named in the reporting — keep the attribution at the cluster level.

Indicators

Unit 42 published host and network indicators; a representative subset, as relayed by The Hacker News:

Download server:   23.240.77[.]233:8085
Dropped files:     pM.js; a.js (saved as index.js); a.wasm (saved as index.wasm);
                   b.js (saved as ipssem.js); dd (saved as lldprx)
Targeted daemons:  /bin/miglogd, /bin/iked
Hook markers:      TCP port 8550, IP 169.254.0.1

Pull the full IOC set from the Unit 42 report rather than this excerpt.

Action checklist

  1. Patch FortiManager and FortiOS now if you haven't. Apply CVE-2024-47575 (if any appliance is still unpatched) and the FG-IR-26-122 fix for CVE-2025-61624.
  2. Assume config compromise on FortiManager-managed fleets. If a FortiManager was exposed, rotate credentials and cryptographic material across all managed FortiGates — the attacker's archive in this case covered 500+ devices.
  3. Hunt on-device, not just on the wire. Check for the daemons and markers above and inspect /bin/miglogd and /bin/iked behavior; a memory-only implant won't show in a file scan or a netflow review.

Context

This is more FortiJump fallout. CVE-2024-47575 has been exploited since 2024 to loot FortiManager-managed fleets; PEERSTITCH shows the same access being parlayed into a stealth implant that survives on tradecraft rather than persistence. If a FortiManager was ever internet-reachable in your estate, the breach you need to rule out is the config theft, not just the current patch level.

Related stories