Security researchers have found a new malware that hides inside Fortinet firewalls. The malware is called PEERSTITCH. It is an ARM64 implant that runs in the memory of the device.
Palo Alto Networks’ Unit 42 shared the findings on October 14, 2026. Its team studied an attack on a telecommunications managed service provider.
Hackers steal data on more than 500 firewalls
Researchers track this activity under two names, CL-STA-0954 and UNC5820. According to Unit 42, the attackers broke into a central FortiManager device in September 2024. They used a critical flaw named CVE-2024-47575, which many people call FortiJump.
The attackers then stole an archive from that device. It held configuration files, credentials, cryptographic material, and network details. All of it is linked to more than 500 managed FortiGate firewalls.
The stolen data gave the attackers a clear view of the provider’s setup. It also showed them how the provider’s client networks were arranged. Researchers said the attackers later used the recovered credentials to open unauthorized SSL VPN sessions. They scanned the network, intercepted traffic, and installed backdoors.
Fortinet credentials have also featured in a separate campaign involving exposed accounts. The FortiBleed campaign reportedly exposed credentials linked to Fortinet devices, including accounts associated with the UK government.
Unit 42 also explained the limits of its work. Its team only studied the provider’s own environment, not the networks of its clients. Exposed client data does not prove that every customer was breached.
PEERSTITCH hides inside real FortiOS processes
The attackers next used CVE-2025-61624, a path traversal flaw in FortiOS and several other Fortinet products. Fortinet published a security advisory for it in April 2026. The public record lists the same flaw. It carries a CVSS score of 5.4. An administrator with enough permissions can use it to write or delete any file. The attacker only needs specially crafted command arguments.
Unit 42 found that the attackers abused the automatic scripting feature of FortiOS. This gave them root-level access. They used that access to install PEERSTITCH.
The malware targets two real FortiOS processes. One is miglogd, which handles logging. The other is iked, which manages VPN tasks. PEERSTITCH injects harmful code into their memory. It then builds a hidden link between the two.
This trick lets the malware work without a lasting file on the disk. It opens no listening ports. It also starts no outbound connections of its own. Instead, it rides on traffic that already passes through the hacked processes.
The implant watches that traffic for certain markers. These include port number 8550 and the IP address 169.254.0.1. When it spots a match, it passes the session identifier from one process to the other.
The VPN process then checks for that identifier in later sessions. Think of it like a secret stamp on a hand at a party gate. If the process finds a matching tag, the injected code changes its path. That new path skips the normal FortiOS security checks.
Attackers wipe logs to cover their tracks
PEERSTITCH was not the only tool in this attack. According to Unit 42, the attackers also abused Apache’s built-in mod_md module. This gave them an SSH-based reverse shell on hacked firewalls. They also posed as the FortiManager platform. That trick lets them pull settings from more managed devices.
Researchers recorded several efforts to erase proof of the break-in. The attackers stopped logging processes and cleared crash logs. They also disrupted telemetry. After each run, they deleted unauthorized administrator accounts and harmful scripting objects.
Some of this activity overlapped with attacks linked to suspected nation-state actors. Even so, the researchers did not name the group behind this operation. The timeline shows how long this threat stayed hidden. The first break-in happened in September 2024. Fortinet shared its advisory in April 2026. Unit 42 then published its findings in October 2026.
The findings point to a risk in central network management systems. One breached management device can expose credentials and settings across hundreds of linked devices.
Organizations that use affected Fortinet products should read the advisory for CVE-2025-61624. They should install the right security updates. They should also check for strange administrator accounts, automatic scripts, and VPN activity. PEERSTITCH runs in memory, so defenders should also inspect process integrity and memory. They are looking for signs of unauthorized code injection.
