Palo Alto Networks’ Unit 42 has described a previously unreported implant called PEERSTITCH that runs only in the memory of two FortiOS processes. It leaves no binary on disk, opens no listening ports and makes no outbound connections of its own; it instead communicates through traffic generated by legitimate processes, which Unit 42 says makes it resistant to conventional endpoint and network detection. The Hacker News reports that it was deployed by exploiting CVE-2025-61624, a path traversal flaw in the FortiOS command line interpreter that Fortinet patched in April 2026 (Fortinet lists the base score as 6.0 and marks it as known exploited).
Unit 42 found PEERSTITCH during a prolonged intrusion at a telecommunications managed service provider in September 2024, tracked as CL-STA-0954 (UNC5820). Initial access came through FortiJump (CVE-2024-47575), a critical FortiManager flaw. From the FortiManager appliance the attackers exfiltrated an archive with the running configurations of more than 500 managed FortiGate firewalls, management databases, topology maps, encrypted credentials and cryptographic material. They then used that information to set up unauthorized SSL/VPN sessions to perimeter firewalls, and exploited CVE-2025-61624 to deploy PEERSTITCH. The implant is a 64-bit ARM64 injector that attaches to the miglogd and iked daemons with ptrace and patches their memory. A hook in miglogd recognizes a marker in passing traffic and hands a session identifier to iked, whose hook then lets tagged VPN sessions take an alternative path that bypasses default FortiOS security validations. Unit 42 also saw the attackers build a separate reverse shell through the Apache mod_md module and clear logs and rogue admin accounts after use.
This is an edge-device intrusion aimed at defenders of managed networks, and Unit 42’s framing is the weaponization of centralized edge-management ecosystems against downstream networks.
How to check if you’re affected
Affected versions per Fortinet’s advisory FG-IR-26-122 are FortiOS 7.6.0 through 7.6.4 (fixed in 7.6.5), FortiOS 7.4.0 through 7.4.9 (fixed in 7.4.10), and all versions of FortiOS 7.2, 7.0 and 6.4, which Fortinet says to migrate to a fixed release. Affected products also include FortiProxy 7.6.0 through 7.6.4 and 7.4.0 through 7.4.11, FortiPAM 1.7.0 and earlier branches, and FortiSwitchManager 7.2.0 through 7.2.7 and 7.0.0 through 7.0.6; see the advisory for exact fixed versions. Exploitation requires a privileged attacker, and Fortinet lists a virtual patch (FG-VD-59270.0day) in FMWP database update 25.120.
Because PEERSTITCH is memory-resident, the sources give no on-disk indicator. The Hacker News lists the download server 23.240.77[.]233 on port 8085 for the implant components, so search firewall and egress logs for connections to it. Anyone who ran FortiManager before it was patched for FortiJump (CVE-2024-47575) should treat that appliance as a possible source of stolen firewall configurations and credentials; rotating credentials and keys for the managed devices is the cautious route, not a step Unit 42 prescribes in the coverage cited here.