Ethical Hacking News
Unveiling the Threat: How PEERSTITCH Malware Exploits FortiOS Vulnerability to Compromise Networks
The cybersecurity landscape has witnessed a significant escalation in malware threats, including the discovery of PEERSTITCH, a sophisticated piece of malware that exploits a vulnerability in Fortinet FortiOS.The attack, which involves the exploitation of CVE-2025-61624, allows a privileged attacker to achieve arbitrary write or delete files via specifically crafted arguments to existing commands.PEERSTITCH leaves no persistent binary on disk, opens no listening ports, and initiates no outbound network connections, making it resistant to conventional endpoint and network detection.The attackers exfiltrated an archive containing information about more than 500 managed FortiGate firewalls, which was used to conduct network reconnaissance, establish long-term access, and deploy backdoors.The malware includes an auto-script designed to download five components from an external server, which are used to launch a process memory patching injector and create a "covert, memory-resident communication bridge" between two legitimate FortiOS processes.The attack highlights the importance of regular system updates, patching, and monitoring to mitigate the risks associated with vulnerabilities like CVE-2025-61624.
The cybersecurity landscape has witnessed a significant escalation in the sophistication and menace of malware threats, with a recent case bringing to light the capabilities of a particularly insidious piece of malware known as PEERSTITCH. This malicious entity has been observed to exploit a vulnerability in Fortinet FortiOS, a widely used network security system, to deliver a previously unreported memory-resident ARM64 malware. The attack, which involves the exploitation of CVE-2025-61624, a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, allows a privileged attacker to achieve arbitrary write or delete files via specifically crafted arguments to existing commands.
The discovery of PEERSTITCH and its association with the exploitation of CVE-2025-61624 highlights a significant vulnerability in the FortiOS system that has been patched by Fortinet in April 2026. However, the fact that the attack has been successful despite the availability of a patch underscores the ongoing threat posed by this vulnerability and the importance of timely patching and updating of systems.
According to Palo Alto Networks Unit 42 researchers Daniel Gott and Shawn Westfall, PEERSTITCH leaves no persistent binary on disk, opens no listening ports, and initiates no outbound network connections. Instead, it communicates through traffic generated by legitimate processes on the infected host, which makes the malware resistant to conventional endpoint and network detection. This approach allows the attackers to create a "covert, memory-resident communication bridge" between two legitimate FortiOS processes, thereby sidestepping detection.
The attack sequence involves the exploitation of the FortiJump vulnerability, a critical flaw in Fortinet FortiManager, to gain initial access to the FortiGate appliance. Following a successful compromise of the appliance, the attackers exfiltrated an archive containing running configurations, cryptographic material, and database files containing information about more than 500 managed FortiGate firewalls. This information was used to conduct network reconnaissance, establish long-term access, intercept network traffic, set up unauthorized FortiGate SSL/VPN sessions, deploy backdoors, and exploit a separate privilege-escalation vulnerability to deploy PEERSTITCH.
The malware, a 64-bit Linux ARM64 executable written in C, includes an auto-script designed to download five components from an external server. These components are pM.js, an environment preparation script (self-deleting); a.js (saved as index.js), an Emscripten JavaScript runtime module; a.wasm (saved as index.wasm), a compiled WebAssembly binary module; b.js (saved as ipssem.js), a deployment orchestrator script; and dd (saved as lldprx), a native ARM64 ELF binary injector (PEERSTITCH core).
The main phase of the attack begins after an execution delay. The orchestrator ("ipssem.js") launches "lldprx," which then serves as a process memory patching injector targeting two core FortiOS daemons: "/bin/miglogd" and "/bin/iked." Specifically, it locates the running processes associated with the two daemons, enumerates their memory layout, attaches to them using ptrace and halts their execution using PTRACE_INTERRUPT, allocates executable memory and writes malicious code into it, and redirects execution through the injected code.
The end goal behind this hooking step is to create a "covert, memory-resident communication bridge" between the two legitimate FortiOS processes instead of using a conventional network connection or file, and use them as a cover to sidestep detection. Specifically, the miglogd hook is equipped to recognize a marker in the data it is passing through the process. This includes two specific markers - TCP port marker - 8550 (embedded within traffic data, not a listening port) and IP address marker - 169.254.0.1 (link-local identifier used for pattern matching).
Once this pattern is identified, it passes the associated session token or identifier to the iked daemon, whose hook later looks for that identifier while handling subsequent VPN sessions. If such a tag exists within that VPN session's injection buffer, it takes an alternative execution path, bypassing default FortiOS security validations.
The attackers have also been observed establishing a separate command-and-control (C2) channel by leveraging the native Apache "mod_md" module on FortiGate firewalls in order to spawn an SSH-based reverse shell. Furthermore, the attackers impersonated the FortiManager platform to pull from managed firewalls of other hosts in the targeted network.
While not definitive, it is suspected that the attackers may have exploited other flaws like CVE-2024-26009 and CVE-2024-26008 to carry out this task. However, Unit 42 emphasized that exploiting these vulnerabilities requires the device to be enrolled in FortiGate Cloud/FortiCloud SSO, which none of the affected firewalls held.
In addition, the attack sequence is marked by various measures to remove forensic artifacts through termination of syslog generation, crash log clearing, logging telemetry disruption, and automatic deletion of rogue administrator accounts and auto-script objects after execution. This underscores the attackers' efforts to maintain operational security and avoid detection.
The discovery of the PEERSTITCH implant demonstrates the increasing technical maturity of edge-device malware. "By operating as a one-shot injector, avoiding persistent disk artifacts and building a covert inter-process communication bridge inside process memory, the attackers achieved sustained persistence while evading traditional monitoring," Unit 42 said.
The intrusion highlights a growing threat, the weaponization of centralized edge management ecosystems to compromise downstream networks. This incident serves as a stark reminder of the importance of regular system updates, patching, and monitoring to mitigate the risks associated with vulnerabilities like CVE-2025-61624.
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-the-Threat-How-PEERSTITCH-Malware-Exploits-FortiOS-Vulnerability-to-Compromise-Networks-ehn.shtml
https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html
Published: Fri Oct 16 02:15:03 2026 by llama3.2 3B Q4_K_M
