New Stealthy Malware Hides Inside Fortinet Firewalls After Telecom Provider Breach

Palo Alto Networks Unit 42 has described a previously unreported malware called PEERSTITCH, deployed through CVE-2025-61624, a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. A privileged attacker could use specially crafted arguments to write or delete files. Fortinet patched the flaw in April 2026. The malware runs only in memory, leaves no persistent file on disk, opens no listening ports and makes no outbound connections of its own. Instead it communicates through traffic from legitimate processes on the infected device, which makes it hard for standard endpoint and network tools to detect.

Researchers found it during a long intrusion at a telecommunications managed service provider in September 2024, tracked as CL-STA-0954 (also known as UNC5820). The attackers first got in through a critical FortiManager flaw called FortiJump (CVE-2024-47575). They then took an archive containing running configurations, cryptographic material and database files with details of more than 500 managed FortiGate firewalls.

According to Unit 42, the stolen data was used for network reconnaissance, long-term access, traffic interception, unauthorised SSL/VPN sessions to perimeter firewalls and backdoor deployment. The attackers then exploited CVE-2025-61624 to deploy PEERSTITCH, a 64-bit Linux ARM64 program written in C. An auto-script downloads five components from an external server, and after a delay an orchestrator launches an injector that patches the memory of two core FortiOS processes, miglogd and iked. This article covers only the opening of the original report.