PEERSTITCH malware

What it does

Names

Public sources use several names for this malware.

How it spreads

How an infection runs

The order of steps in a typical infection, as the sources describe it.

1. 1

   First access

   Attackers used CVE-2024-47575 through crafted requests to the FortiManager management channel on TCP port 541.^{[1, 2]}

2. 2

   Data theft

   After registering a device, they created a configuration archive named .tm on the FortiManager and took it out.^[1]

3. 3

   Root on FortiOS

   Using CVE-2025-61624 and a path traversal in the FortiOS auto-script feature, they moved from administrator access to root.^{[1, 3]}

4. 4

   Staging

   A loader fetched five files from a server on port 8085 into a template folder on the device, including the PEERSTITCH core, which then deleted its own file.^[1]

5. 5

   Injection

   The core attached to miglogd and iked with ptrace, wrote a 1,344 byte payload into a 16 KB memory block and patched code to redirect execution.^[1]

6. 6

   Quiet signalling

   The hooks watch traffic for set markers and pass tags between the two processes, so iked takes an alternate branch that skips default validation.^[1]

Timeline

1. September 2024

   Intrusion

   Unit 42 says the multi-stage intrusion against a telecommunications managed service provider occurred in September 2024, followed by an extended dwell period. The report gives no date for the later FortiOS stage.^[1]

2. 23 October 2024

   Fortinet advisory for CVE-2024-47575

   Fortinet publishes FG-IR-24-423 for the FortiManager flaw and marks it known exploited. CISA adds the CVE to its Known Exploited Vulnerabilities catalog the same day.^{[2, 4]}

3. 14 April 2026

   Fortinet advisory for CVE-2025-61624

   Fortinet publishes FG-IR-26-122 for the FortiOS auto-script path traversal and lists it as known exploited.^{[3, 6]}

4. 14 October 2026

   Unit 42 report

   Palo Alto Networks Unit 42 publishes its analysis of PEERSTITCH and the intrusion cluster CL-STA-0954.^[1]

5. 16 October 2026

   CISA lists CVE-2025-61624

   CISA adds the FortiOS flaw to its Known Exploited Vulnerabilities catalog without naming any malware.^{[4, 7]}

Related vulnerabilities

• Vulnerability FortiManager missing authentication (CVE-2024-47575) CVE-2024-47575 is a missing authentication flaw in the FortiManager service that talks to managed firewalls. CVE-2024-47575 · Fortinet · Missing authentication for a critical function (CWE-306) in the FortiManager device management service, allowing remote code or command execution
• Vulnerability Fortinet CLI path traversal flaw (CVE-2025-61624) CVE-2025-61624 is a path traversal flaw in the command line of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. CVE-2025-61624 · Fortinet · Path traversal in the command line interpreter (CWE-22), allowing arbitrary file write or delete

Detection and defense

1. Patch both flaws

   Upgrade FortiManager to a fixed release listed in FG-IR-24-423 and FortiOS to a fixed release listed in FG-IR-26-122. Move branches without a fix to a supported release.^{[2, 3]}

2. Restrict the management channel

   Fortinet advises refusing unknown devices with fgfm-deny-unknown and allowing only expected FortiGate addresses to reach port 541. Unit 42 advises treating management interfaces with the strictest isolation.^{[1, 2]}

3. Treat stored secrets as exposed

   Unit 42 says credentials and certificates held on a compromised management platform stay valid until rotated. Fortinet advises changing credentials on FortiManager and on managed devices.^{[1, 2]}

4. Look in memory, not only on disk

   Unit 42 suggests hunting for anonymous 16 KB read-write-execute regions in miglogd and iked, crash logs with signal 11 events, and auto-script entries containing path traversal strings.^[1]

5. Use the vendor signatures

   Unit 42 cites Palo Alto Networks Threat Prevention signatures 95788 and 96788 for CVE-2024-47575. CISA marks CVE-2025-61624 for forensic triage.^{[1, 4]}