Log in Request a demo

Malware profile

PEERSTITCH malware

Also known as lldprx

PEERSTITCH is a small Linux program that Palo Alto Networks Unit 42 found on Fortinet FortiGate firewalls.

In short

PEERSTITCH is a small Linux program that Palo Alto Networks Unit 42 found on Fortinet FortiGate firewalls. It injects code into two running system processes and leaves no file on disk. Unit 42 ties it to an intrusion that began with a FortiManager flaw.

Last updated 19 October 2026

Profile MapMalware
  1. Names2names in public reportsPEERSTITCH · lldprx
  2. Infection Steps6in the delivery chainFirst access · Data theft

In one minute

What it is
A small Linux program that hides inside two running processes on a Fortinet firewall and leaves no file on disk, as described by Palo Alto Networks Unit 42.
What it does
Injects code into the FortiOS processes miglogd and iked, then passes hidden tags between them so iked skips some default checks. Unit 42 says it opens no ports and makes no outbound connections.
Who uses it
Attributed by Palo Alto Networks Unit 42 to a cluster it tracks as CL-STA-0954, also called UNC5820. Unit 42 says parts of the activity overlap with intrusions attributed to suspected nation-state actors and does not name a state. No government body has named PEERSTITCH.
How it gets in
In the case Unit 42 describes, attackers used FortiManager flaw CVE-2024-47575 for first access and FortiOS flaw CVE-2025-61624 to reach root and drop the program.
What to do first
Patch FortiManager and FortiOS as Fortinet advises, restrict the FortiManager port 541 to known devices, and rotate credentials and certificates stored on any management platform that may have been exposed.

What it does

Palo Alto Networks Unit 42 describes PEERSTITCH as a 64-bit ARM64 Linux program that runs once. It attaches to the logging process miglogd and the VPN process iked, writes a small block of code into each, and patches a few instructions so execution jumps into that code. The hooks then pass hidden tags between the two processes, and iked takes a different path that skips some default checks.

Unit 42 says PEERSTITCH leaves no program file on disk, opens no listening ports and makes no outbound connections. The attackers kept remote access by other means. Unit 42 reports a separate reverse shell built on the Apache certificate renewal module, so that channel is not part of PEERSTITCH itself.

The report names CVE-2024-47575 in FortiManager and CVE-2025-61624 in FortiOS. Unit 42 says the intrusion occurred in September 2024 and that the attackers stayed for an extended dwell period before moving on. It does not say when CVE-2025-61624 was used or whether the flaw was still unknown at that time. Fortinet published its advisory for CVE-2025-61624 on 14 April 2026.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
PEERSTITCHName used by Palo Alto Networks Unit 42 for the injector[1]
lldprxFile name under which the PEERSTITCH core was saved on the device, per Unit 42[1]

How it spreads

Unit 42 does not describe PEERSTITCH spreading by itself. In the intrusion it reports, attackers got into a FortiManager with CVE-2024-47575, moved to FortiOS devices, used CVE-2025-61624 to gain root and then had a loader fetch five files, including the PEERSTITCH program, from a server they controlled.

How an infection runs

The order of steps in a typical infection, as the sources describe it.

  1. First access

    Attackers used CVE-2024-47575 through crafted requests to the FortiManager management channel on TCP port 541.[1, 2]

  2. Data theft

    After registering a device, they created a configuration archive named .tm on the FortiManager and took it out.[1]

  3. Root on FortiOS

    Using CVE-2025-61624 and a path traversal in the FortiOS auto-script feature, they moved from administrator access to root.[1, 3]

  4. Staging

    A loader fetched five files from a server on port 8085 into a template folder on the device, including the PEERSTITCH core, which then deleted its own file.[1]

  5. Injection

    The core attached to miglogd and iked with ptrace, wrote a 1,344 byte payload into a 16 KB memory block and patched code to redirect execution.[1]

  6. Quiet signalling

    The hooks watch traffic for set markers and pass tags between the two processes, so iked takes an alternate branch that skips default validation.[1]

Timeline

  1. September 2024

    Intrusion

    Unit 42 says the multi-stage intrusion against a telecommunications managed service provider occurred in September 2024, followed by an extended dwell period. The report gives no date for the later FortiOS stage.[1]

  2. 23 October 2024

    Fortinet advisory for CVE-2024-47575

    Fortinet publishes FG-IR-24-423 for the FortiManager flaw and marks it known exploited. CISA adds the CVE to its Known Exploited Vulnerabilities catalog the same day.[2, 4]

  3. 14 April 2026

    Fortinet advisory for CVE-2025-61624

    Fortinet publishes FG-IR-26-122 for the FortiOS auto-script path traversal and lists it as known exploited.[3, 6]

  4. 14 October 2026

    Unit 42 report

    Palo Alto Networks Unit 42 publishes its analysis of PEERSTITCH and the intrusion cluster CL-STA-0954.[1]

  5. 16 October 2026

    CISA lists CVE-2025-61624

    CISA adds the FortiOS flaw to its Known Exploited Vulnerabilities catalog without naming any malware.[4, 7]

Detection and defense

  1. Patch both flaws

    Upgrade FortiManager to a fixed release listed in FG-IR-24-423 and FortiOS to a fixed release listed in FG-IR-26-122. Move branches without a fix to a supported release.[2, 3]

  2. Restrict the management channel

    Fortinet advises refusing unknown devices with fgfm-deny-unknown and allowing only expected FortiGate addresses to reach port 541. Unit 42 advises treating management interfaces with the strictest isolation.[1, 2]

  3. Treat stored secrets as exposed

    Unit 42 says credentials and certificates held on a compromised management platform stay valid until rotated. Fortinet advises changing credentials on FortiManager and on managed devices.[1, 2]

  4. Look in memory, not only on disk

    Unit 42 suggests hunting for anonymous 16 KB read-write-execute regions in miglogd and iked, crash logs with signal 11 events, and auto-script entries containing path traversal strings.[1]

  5. Use the vendor signatures

    Unit 42 cites Palo Alto Networks Threat Prevention signatures 95788 and 96788 for CVE-2024-47575. CISA marks CVE-2025-61624 for forensic triage.[1, 4]

Questions

What is PEERSTITCH?

A Linux program for Fortinet FortiGate firewalls described by Palo Alto Networks Unit 42. It injects code into two running processes and leaves no file on disk.

Which Fortinet flaws does the report name?

CVE-2024-47575 in FortiManager for first access and CVE-2025-61624 in FortiOS to reach root. Unit 42 also names two lower-confidence possibilities and says it could not confirm them.

Who is behind it?

Unit 42 tracks the activity as CL-STA-0954, also called UNC5820, and says parts overlap with intrusions attributed to suspected nation-state actors. It names no state, and no government body has named PEERSTITCH.

Does it show up in file scans?

Unit 42 says PEERSTITCH leaves no persistent file on disk, so file checks alone can miss it. Its hunting advice looks at process memory and crash logs.

Is CVE-2025-61624 tied to this by CISA or Fortinet?

No. CISA lists the flaw as exploited and Fortinet marks it known exploited, but neither names PEERSTITCH. The link comes from the Unit 42 report.

Sources

  1. Analysis of CVE-2024-47575 intrusion and PEERSTITCH (attributed by Unit 42) Palo Alto Networks Unit 42, 14 October 2026Supports: Malware behaviour, flaws used, cluster name, timing, hunting advice.
  2. FG-IR-24-423 Missing authentication in fgfmsd Fortinet PSIRTSupports: Affected versions, workarounds, known exploited flag, publication date.
  3. FG-IR-26-122 Path Traversal in CLI Fortinet PSIRTSupports: Affected versions, known exploited flag, 14 April 2026 date.
  4. Known Exploited Vulnerabilities catalog (data file) CISASupports: KEV entries and dates for CVE-2024-47575 and CVE-2025-61624.
  5. CVE-2024-47575 record NIST NVDSupports: Description, score and affected versions.
  6. CVE-2025-61624 record NIST NVDSupports: Description and publication date.
  7. CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA, 16 October 2026Supports: CVE-2025-61624 added to the catalog.

Browse the threat library