PEERSTITCH: How Attackers Weaponized FortiOS Internals to Build an Invisible VPN Backdoor
In September 2024, a suspected advanced persistent threat actor tracked as CL-STA-0954 (UNC5820) compromised a telecommunications managed service provider by chaining two Fortinet vulnerabilities. Initial access was gained via CVE-2024-47575 (FortiJump) targeting FortiManager, enabling exfiltration of configurations, private keys, and metadata for over 500 managed FortiGate firewalls. Attackers then exploited CVE-2025-61624, a FortiOS path traversal flaw, to deploy PEERSTITCH—a memory-resident ARM64 implant that injects hooks into legitimate daemons (miglogd and iked) to create a covert inter-process communication bridge, effectively bypassing VPN session security checks without leaving disk artifacts. This incident signals an accelerating trend of state-linked actors weaponizing centralized network management platforms to compromise downstream infrastructure at scale. The combined use of living-off-the-land injection techniques, WebAssembly payloads, and forensic artifact removal represents a maturation of edge-device malware tradecraft that outpaces conventional endpoint and network detection approaches.
Kill Chain
