PEERSTITCH: CL-STA-0954 Planted a Memory-Resident Implant on 500+ FortiGate Firewalls - Hunt for It Now

CVE-2024-47575 is a missing authentication vulnerability (CVSS 9.8) in the FortiManager FMG-Access management channel on TCP port 541. The flaw allows an unauthenticated remote attacker to execute arbitrary commands by sending crafted requests that register a rogue virtual FortiGate to a target FortiManager instance. There are no credentials required, no user interaction needed, and no prior access to the network.

CL-STA-0954 used this vector to register a rogue virtual FortiGate named "localhost" with the serial number FMG-VMTM23017412, originating from the external staging IP 45.32.41.202. Immediately after successful registration, the attackers generated a configuration archive and exfiltrated it. That archive contained:

• Complete running configuration files for more than 500 managed FortiGate firewalls
• Central management SQLite databases (global.db and revinfo.db) covering every enrolled device, policy package, and revision
• A flat-text inventory of every FortiGate serial number alongside its public IP
• Internal network topology maps, routing tables, and interface configurations
• Ciphertext administrative, local, and SSL/VPN credentials
• Encoded private keys and public certificates for every managed device

Unit 42 confirmed that the SSL/VPN and administrative passwords were recoverable from the exfiltrated configurations by brute force. The actors then established unauthorized SSL/VPN sessions to perimeter firewalls from known staging infrastructure at 23.240.77.233 and 47.18.167.159, gaining authenticated access to internal network-management segments.

The FortiManager is the single point of failure for every firewall it manages. One successful exploitation of CVE-2024-47575 hands an attacker complete visibility and access to the entire managed estate.

PEERSTITCH is a 64-bit Linux ARM64 executable written in C and statically linked against glibc. It acts as a one-shot process memory patching injector. The delivery chain begins when CL-STA-0954 exploits CVE-2025-61624, a path traversal in the FortiOS CLI auto-script engine. By naming an auto-script object with traversal sequences (../../../../setup), the attackers write a JavaScript loader script to an arbitrary filesystem location and execute it with root privileges. The loader downloads five files from attacker infrastructure at hxxp://23.240.77[.]233:8085/ - including the ARM64 injector (saved as lldprx) - into /data2/template/.

The lldprx binary then:

1. Iterates /proc/ to locate the PIDs for /bin/miglogd and /bin/iked
2. Reads /proc/[pid]/maps to extract base addresses of both daemons
3. Attaches to each process via ptrace(PTRACE_SEIZE) and halts execution
4. Snapshots all ARM64 registers (X0 through X30, SP, and PC)
5. Allocates a 16,384-byte RWX anonymous memory region via mmap in each process
6. Writes a 1,344-byte injection payload into each RWX buffer via /proc/[pid]/mem
7. Applies NOP patches (0xAA0003E0 on ARM64) at three static text-segment offsets and writes a trampoline patch to redirect execution into the hook buffer

The hook code in both daemons then builds a covert shared-memory bridge: when either daemon processes data matching embedded markers (TCP port 8550 or link-local IP 169.254.0.1), it extracts session tokens and writes them into a 16-slot circular ring buffer in the counterpart daemon's memory via /proc/[counterpart_pid]/mem. When iked processes subsequent VPN sessions, its hook checks this buffer and - if a matching token exists - takes an alternate return path that bypasses FortiOS security validations.

The result: PEERSTITCH intercepts and manipulates VPN session handling without creating any file on disk, without opening any socket, and without generating any traffic of its own. Standard controls - file integrity monitoring, network detection, process listing, and port scanning - all miss it.

Following the initial FortiManager breach, CL-STA-0954 used the compromised appliance to push unauthorized packet-capture configurations to multiple downstream managed FortiGate firewalls. The captures targeted unencrypted HTTP traffic and 11 specific TCP services (ports 3696-3706) covering remote administration, license management, telemetry, and web services discovery. A subsequent sniffing phase targeted UDP port 69 (TFTP), UDP ports 1812-1813 (RADIUS and RADIUS accounting), and TCP port 389 (LDAP), enabling active directory query interception, authentication sniffing, and file/firmware capture.

The actors also established persistence through a second channel: weaponizing the native Apache mod_md (Managing Domains) module on FortiGate firewalls. They created a rogue ACME configuration that mapped DNS-01 certificate validation challenges to /bin/node. When Apache initiates certificate renewal, it executes Node.js with parameters fetched from the attacker's ACME server, and the domain name field carries an injected shell command. Setting MDRenewMode to always forced continuous polling, creating a persistent outbound reverse shell to kali@23.240.77.233:8084 that re-established itself on every ACME renewal cycle.

The actors' anti-forensic discipline was extensive. They killed miglogd and syslogd before executing malicious auto-scripts, cleared crash logs via diagnose debug crashlog clear, rolled back rogue admin accounts and auto-script objects automatically after deployment, and overwrote the md-acme.conf file with benign content to mask the reverse shell configuration. Unit 42 assesses with medium confidence that the actors also deliberately induced telemetry drops on the tunnel management interface during active operations.

The Ivanti Connect Secure zero-day chain published three days before this disclosure shows the same pattern: nation-state-linked actors targeting perimeter VPN infrastructure with chained exploits, maintaining access through anti-forensic persistence, and deliberately suppressing logging during operations.

Unit 42 tracks this activity as CL-STA-0954, which overlaps with UNC5820 in Mandiant's nomenclature. The actor's targeting of a telecommunications managed service provider reflects a deliberate strategy: compromise the management layer to inherit access to every downstream client network without needing to breach each one individually. A single FortiManager yielded cryptographic trust material for 500+ firewalls protecting the MSP's own infrastructure and its clients' networks.

The technical profile is inconsistent with typical criminal ransomware operations. The actors demonstrated deep familiarity with FortiOS internals, ARM64 process memory layout, and the FortiManager FGFM protocol. Exploiting CVE-2025-61624 via the auto-script engine requires knowledge of how FortiOS validates and executes management objects that is not publicly documented. The PEERSTITCH injector's use of ptrace for process parasitization, cross-daemon memory sharing via /proc/[pid]/mem, and its specific NOP patch targeting of three static daemon offsets required prior binary analysis of FortiOS images.

Unit 42 assesses with low confidence that CL-STA-0954 is criminally motivated rather than espionage-focused, but acknowledges the overlap with suspected nation-state TTPs. The MITRE ATT&CK techniques observed include:

• T1190: Exploit Public-Facing Application (FortiJump, CVE-2024-47575)
• T1055.008: Process Injection via ptrace (PEERSTITCH implant delivery)
• T1040: Network Sniffing (RADIUS, LDAP, TFTP interception)
• T1136.001: Create Account (rogue FortiGateCloud admin account creation)
• T1070.004: Indicator Removal via file deletion and log clearing
• T1133: External Remote Services (unauthorized SSL/VPN sessions)
• T1587.001: Develop Capabilities (custom PEERSTITCH malware)

The Qilin and Settra ransomware groups exploiting GlobalProtect CVE-2026-0257 earlier this year used a similar playbook: authenticate into a target network via stolen VPN credentials derived from perimeter device exploitation, then pivot laterally using Cobalt Strike and BloodHound. CL-STA-0954's approach is significantly more sophisticated, implying either greater resourcing or state backing.

The IOCs below come from the Unit 42 analysis published October 14, 2026. The IP addresses are defanged in the original report but are presented here in copy-paste-ready format for direct SIEM and firewall rule use. Block or alert on these indicators across all network segments, particularly on perimeter egress rules for FortiGate management traffic.

Two generated Sigma rules target PEERSTITCH detection: the first catches the auto-script path traversal exploit pattern (CVE-2025-61624), and the second detects the ptrace-based process injection used to plant the implant in miglogd and iked. Both carry experimental status; validate against your FortiGate log format and EDR telemetry before enabling automatic blocking.

Because PEERSTITCH lives entirely in process memory, standard patching and file scanning cannot remove it. Remediation requires confirming whether the implant is present, then rebuilding affected devices from clean configurations. Follow these steps in order.