Palo Alto Networks Unit 42 has published its analysis of PEERSTITCH, a memory-resident implant that ran on FortiGate firewalls inside a telecom managed service provider. The intrusion began in September 2024. Unit 42 tracks the actor as CL-STA-0954, also known as UNC5820, and says some post-exploitation behaviour overlaps with suspected nation-state intrusions. The report was published on October 14, 2026.
Why it matters. The attackers pulled configuration and credential data for more than 500 managed FortiGate firewalls from a single FortiManager. The archive held running configurations, databases, ciphertext admin and SSL/VPN credentials, topology maps and private keys. Unit 42 scoped its work to the provider's own environment and did not examine downstream customers. The Hacker News reports that CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on October 16, with a federal deadline of October 19.
The intrusion chain, per Unit 42. The actor exploited FortiJump (CVE-2024-47575) on FortiManager and registered a rogue virtual FortiGate named "localhost". It exfiltrated the archive, brute-forced the recovered admin and VPN passwords, and logged in to perimeter firewalls. It then used CVE-2025-61624, a path traversal in the FortiOS CLI auto-script engine, to reach root and deploy the loader. Fortinet patched CVE-2025-61624 in April 2026. Unit 42 also assesses with medium confidence that CVE-2024-26009 was used to impersonate FortiManager and CVE-2024-26008 to disrupt telemetry.
How the implant works. PEERSTITCH is a 64-bit ARM64 Linux executable written in C. It is a one-shot ptrace injector that patches two daemons, /bin/miglogd (logging) and /bin/iked (IKE/IPsec VPN). It writes a 1,344-byte payload into a 16,384-byte RWX region in each, then deletes its own binary. It opens no listening ports and makes no outbound connections of its own. The miglogd hook watches daemon traffic for the markers 8550 and 169.254.0.1 and extracts a session tag. It hands the tag to iked through /proc/<pid>/mem. When iked sees a matching tag, it takes an alternate return path that bypasses the default FortiOS validation.
A second command channel abused Apache mod_md on the firewall. The attackers wrote an ACME configuration through the auto-script engine, pointed it at their own server and mapped the DNS-01 challenge to /bin/node. Injected commands in the domain field started an SSH-based reverse shell. With MDRenewMode set to "always", the payload re-ran repeatedly. The actor also stopped miglogd and syslogd, cleared crash logs and deleted rogue admin accounts, VPN groups and auto-script objects after use.
Detection guidance from Unit 42. Look for anonymous 16,384-byte rwxp regions in /proc/<pid>/maps for miglogd and iked. Check the text segment for NOP patches (0xAA0003E0) at the three offsets listed in the report. Audit open and write calls to /proc/<pid>/mem between the two daemons. Search for Signal 11 crashes in miglogd, iked or syslogd. Hunt for system.auto-script objects containing ../ traversal strings. Known infrastructure includes 23.240.77[.]233 and 47.18.167[.]159, and the report includes a YARA rule, u42_apt_linux_PEERSTITCH_fortigate_implant, and full hashes.
Mitigation. Patch FortiOS for CVE-2025-61624 and check Fortinet PSIRT advisories for fixed releases. Isolate FortiManager and edge management interfaces behind zero-trust access. Treat every credential and certificate held on a compromised management platform as compromised and rotate them. Exfiltrated trust material stays valid until rotated. Patching does not evict an implant that is already resident in memory, so run the memory checks above on firewalls managed by any FortiManager that was exposed before patching.
