PEERSTITCH malware exploits Fortinet flaws to compromise 500 firewalls

Researchers from Palo Alto Networks Unit 42 have identified a sophisticated cyberattack involving the deployment of PEERSTITCH, a memory-resident ARM64 malware. The intrusion targeted a telecommunications managed service provider, beginning in September 2024.

Attackers initially gained access by exploiting a critical vulnerability in FortiManager known as FortiJump (CVE-2024-47575). This allowed them to exfiltrate an archive containing running configurations, cryptographic material, and database files for more than 500 managed FortiGate firewalls. These devices protected both the service provider’s internal infrastructure and the networks of its various clients.

Following the initial compromise, the threat actor utilized a path traversal flaw in FortiOS (CVE-2025-61624) to deploy the PEERSTITCH malware. The malware is designed for high stealth; it leaves no persistent binary on the disk, opens no listening ports, and initiates no outbound network connections. Instead, it communicates through traffic generated by legitimate processes on the infected host, making it resistant to conventional endpoint and network detection methods.