Overview
A sophisticated threat actor has demonstrated how compromising a centralised Fortinet management environment can become far more dangerous than compromising a single firewall. Researchers have identified a previously undocumented memory-resident ARM64 malware named PEERSTITCH, deployed after attackers gained access to Fortinet infrastructure and harvested configurations and cryptographic material relating to more than 500 managed FortiGate firewalls. The campaign demonstrates a worrying evolution in edge-device attacks: rather than simply installing a conventional backdoor, the attackers manipulated legitimate FortiOS processes and created a covert communication mechanism entirely within process memory.
From FortiManager to the Wider Network
The intrusion began with the compromise of a FortiManager appliance through the previously disclosed FortiJump vulnerability, CVE-2024-47575. Once inside the management platform, attackers reportedly obtained running configurations for more than 500 FortiGate firewalls, serial numbers, public IP addresses, network topology information, routing and interface configurations, database files, encrypted credentials and cryptographic trust material. That information fundamentally changes the scale of the compromise. A firewall compromise normally represents a security incident involving one perimeter device. A compromised central management platform can potentially provide the attacker with knowledge and access relationships spanning an entire fleet. The management plane therefore becomes an extremely valuable target—not because it necessarily carries production traffic itself, but because it understands and controls the infrastructure that does.
PEERSTITCH Lives Inside Legitimate Processes
The attackers subsequently exploited CVE-2025-61624, a FortiOS path-traversal flaw that permits a privileged attacker to write or delete files using specially crafted command arguments. PEERSTITCH itself is designed to minimise conventional indicators of compromise. It is an ARM64 Linux executable written in C, but its most significant capability is not simply executing as another process. The malware injects code directly into the memory of two legitimate FortiOS daemons: miglogd and iked. The injector locates the processes, examines their memory layouts, attaches using ptrace, allocates executable memory and redirects execution into the injected code. This creates a powerful evasion mechanism. There is no conventional PEERSTITCH listening service waiting for connections, and the malware does not need to establish its own outbound network connection. Instead, it abuses processes that FortiOS already trusts.
VPN Traffic Becomes the Covert Channel
The injected components create a communication bridge between the two legitimate FortiOS processes. The miglogd hook looks for specially crafted markers within traffic. When the expected information is identified, it passes a session identifier to the iked daemon. The VPN process can then recognise that identifier in a subsequent session and take an alternative execution path that bypasses normal FortiOS security validations. This is an important distinction from a traditional backdoor. The attacker is not necessarily creating an obviously malicious network service. The malicious behaviour has been inserted into the normal execution path of a security appliance. Traffic that appears legitimate can therefore become the carrier for attacker-controlled behaviour.
The Security Appliance Is Part of the Attack Surface
The campaign also reportedly used legitimate Fortinet components and management relationships to expand access, while attackers attempted to impersonate FortiManager to communicate with other managed firewalls. They additionally disrupted logging, cleared crash information, terminated syslog generation and removed rogue administrative accounts and scripts after execution. This demonstrates why edge-device security cannot rely exclusively on traditional endpoint controls. Firewalls, VPN gateways and management platforms are themselves specialised operating environments. They may have limited forensic tooling, highly privileged processes and management relationships with large numbers of downstream systems.
Expert in the Cloud Insight
PEERSTITCH illustrates a fundamental architectural risk in centralised security management:
The more infrastructure a management platform controls, the greater the consequences when that platform is compromised.
The attack also demonstrates why traditional assumptions about malware detection are becoming less reliable. A malicious implant does not necessarily need persistence on disk, a dedicated listening port or its own outbound connection. It can hide inside legitimate processes and abuse legitimate communications. For enterprise security architecture, the management plane deserves the same—and often greater—protection as the production network it controls. A trusted firewall process is still trusted infrastructure. Once its execution path has been altered, that trust becomes the attacker’s advantage.
Leave a Reply