Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

Unit 42 has uncovered PEERSTITCH, a sophisticated, memory-resident malware used by attackers to gain long-term access to a telecommunications managed service provider's network. The attackers exploited CVE-2024-47575 (FortiJump) to gain initial access, then leveraged this to exfiltrate configuration and credential data. They used PEERSTITCH to maintain persistent access, intercept network traffic, establish VPN sessions, and deploy backdoors. The malware operates without leaving persistent files and communicates through legitimate processes, making detection difficult. The incident involved over 500 managed FortiGate firewalls, protecting both the provider's infrastructure and its clients’ networks. The attackers demonstrated advanced tradecraft, including impersonating FortiManager and exploiting a separate privilege escalation vulnerability (CVE-2025-61624).