PEERSTITCH, a Stealthy FortiGate Implant

In September 2024, a sophisticated multi-stage intrusion targeted a telecommunications organization by exploiting CVE-2024-47575 on a FortiManager appliance to exfiltrate configurations and cryptographic material for over 500 FortiGate firewalls. Subsequently, attackers exploited CVE-2025-61624 to deploy PEERSTITCH, a novel ARM64 memory-resident malware implant that avoids disk and network detection. The implant patches running processes, creates covert inter-process communication channels, and intercepts network traffic. Additional attack techniques included using Apache mod_md for reverse shell command and control, impersonating FortiManager to compromise downstream devices, and employing extensive anti-forensic measures. The attack demonstrates advanced tradecraft consistent with nation-state actors and highlights the critical risk of centralized edge management platforms.

• CVE-2025-61624: Fortinet FortiOS · Escalation of PrivilegeMediumVulnerability2026-04-14
• CVE-2024-47575: Fortinet FortiManager Missing Authentication VulnerabilityCriticalVulnerability2024-10-23
• Ivanti CVE-2026-104935: Zero-Day Chain Exploited in Operation InnovateExploitedCampaign2026-10-14
• PHP2Shell Exploitation on Check Point GatewayMalware2026-11-12
• The global socket: how threat actors are weaponizing GSocket for stealthy C2Malware2026-11-11