Loading malware…
PEERSTITCH is a memory-resident backdoor written in C for ARM64 Linux-based Fortinet FortiGate appliances running FortiOS. It enables specially marked VPN sessions to bypass normal FortiOS security checks by modifying legitimate logging and IKE/IPsec VPN processes in memory.
The implant uses ptrace to attach to the targeted daemons, allocate executable memory, insert malicious code, and redirect execution through injected hooks. These hooks establish a covert inter-process communication bridge. A hook in the logging daemon recognizes markers within processed traffic and transfers an associated session identifier into the VPN daemon’s memory. Subsequent VPN traffic carrying the matching identifier is diverted through an alternative execution path that bypasses standard security validations. PEERSTITCH opens no listening ports and initiates no outbound connections of its own, instead using traffic handled by legitimate processes. Its injector deletes its executable after deployment, leaving the active implant in process memory rather than as a persistent on-disk binary.
PEERSTITCH was deployed by the activity cluster CL-STA-0954, also tracked as UNC5820, during an intrusion into a telecommunications managed service provider. The attackers exploited FortiManager vulnerability CVE-2024-47575 for initial access and stole configurations, credentials, and cryptographic material associated with more than 500 managed FortiGate firewalls. They subsequently exploited the privileged FortiOS auto-script path traversal vulnerability CVE-2025-61624 to deploy PEERSTITCH on selected appliances. Exposure of the management data did not establish that every associated firewall or downstream customer network was compromised.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
This advanced attack leverages a path traversal flaw, CVE-2025-61624, to achieve arbitrary file manipulation, enabling the deployment of this stealthy implant. | A sophisticated threat actor was observed exploiting a security vulnerability in Fortinet FortiOS to deploy a novel memory-resident ARM64 malware known as PEERSTITCH.
In the September 2024 intrusion, the attackers exploited CVE-2024-47575, also known as FortiJump, against FortiManager. The flaw let an unauthenticated remote attacker send crafted requests through the device’s management channel and run commands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
„PEERSTITCH не остава постојана извршна датотека на дискот, не отвора порти што слушаат и не иницира излезни мрежни врски“.
“PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections. Instead, it communicates through traffic generated by legitimate processes on the infected host.”
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An ARM64 implant deployed on Fortinet FortiOS devices through exploitation of CVE-2025-61624. It injects malicious code into the core FortiOS daemons miglogd and iked to create a covert, memory-resident communication bridge. It avoids persistent disk traces and listening ports, instead communicating through legitimate processes. Researchers observed it during a prolonged intrusion against a telecommunications managed service provider.
A C-written ARM64 Linux implant deployed on Fortinet FortiGate devices through exploitation of CVE-2025-61624. Its native injector, saved as lldprx, uses ptrace to inject code into the FortiOS miglogd and iked daemons. These hooks establish a covert in-memory communication bridge, recognize markers embedded in legitimate traffic, and alter handling of tagged VPN sessions to bypass standard security checks. The implant avoids a persistent on-disk executable, listening ports, and its own outbound connections, concealing its activity within legitimate processes and traffic.
A 64-bit ARM64 implant written in C that maintains stealthy access to FortiOS devices. It injects into the logging and VPN daemons and bridges their memory to transfer session tokens, enabling specially tagged VPN sessions to bypass security checks. Its injector deletes its on-disk binary, while the implant operates through existing processes without opening listening ports or initiating outbound connections. Detection requires live-memory inspection for anomalous read-write-execute regions or code patches; disk-based integrity checks miss it. Attackers deployed it using CVE-2025-61624 after initially compromising FortiManager through CVE-2024-47575 and stealing configurations and cryptographic material covering more than 500 managed firewalls.
Previously unreported Linux ARM64 malware written in C that operates as a one-shot injector on FortiOS appliances. It uses ptrace to inject hooks into the legitimate miglogd and iked daemons, creating a covert, memory-resident communication bridge. The hooks recognize embedded traffic markers and transfer session identifiers between the processes, causing selected VPN sessions to bypass normal FortiOS security validations. It avoids persistent on-disk binaries, listening ports, and outbound connections, instead communicating through traffic handled by legitimate processes.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.