Skip to content

Response, New York. Noah Park: Check Point Patches Actively Exploited Management Server Path Traversal. Detection, Dallas. Ava Okello: Report Finds Nearly Half of Deployed Detections Need Attention Before SOCs Can Trust Them.

SOCtember

Always First. Fast SOC News.

Unit 42 research splash graphic introducing analysis of the PEERSTITCH memory-resident FortiGate implant after a FortiManager breach.
Screenshot: Unit 42, blog splash graphic for Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant, Oct 14, 2026 (fair use).

Threat Intel

Unit 42 Says PEERSTITCH Memory-Resident FortiGate Implant Followed a FortiManager Breach That Exposed More Than 500 Firewalls

Unit 42 tracks CL-STA-0954 exploiting FortiJump to steal configs and credentials from a telecom MSP FortiManager, then using CVE-2025-61624 to inject PEERSTITCH into miglogd and iked with no disk binary, no listening ports, and no outbound sockets of its own.

Priya Shah, Threat IntelSingapore6 min read

SINGAPORE - Unit 42 researchers said on Oct. 14, 2026 that a cluster they track as CL-STA-0954, also known as UNC5820, breached a telecommunications managed service provider in September 2024 by exploiting FortiManager CVE-2024-47575, then later planted PEERSTITCH, a novel memory-resident ARM64 implant, on selected FortiGate firewalls. The analysts, Daniel Gott and Shawn Westfall, say the FortiJump-class exploit against the central FortiManager yielded running configurations, cryptographic material, and database files covering more than 500 managed FortiGate devices that protected the provider and its clients. After a long dwell, the attackers cracked reversible ciphertext credentials, returned over SSL VPN, escalated to root with FortiOS CVE-2025-61624, and injected PEERSTITCH into the miglogd and iked daemons. For SOC and network-defense teams, the implant's design is the hard problem: it leaves no persistent binary on disk, opens no listening ports, and starts no outbound sockets of its own, instead parasitizing traffic already moving through legitimate FortiOS processes.

Unit 42 flowchart showing PEERSTITCH process discovery, ptrace attach, RWX mmap, and hook injection into miglogd and iked.
Screenshot: Unit 42, Figure 3, Flowchart of PEERSTITCH activity, Oct 14, 2026 (fair use).Unit 42 traces the implant from a downloader through ptrace attachment and an in-memory wipe.

Unit 42 says the attackers registered a rogue Virtual FortiGate named localhost to the FortiManager over the FMG-Access channel on TCP port 541, then exfiltrated a configuration archive that held serial numbers, public IP inventory, topology and routing data, ciphertext administrative and SSL VPN credentials, and trust material for FGFM management. They later pushed unauthorized sniffer rules toward TFTP, RADIUS, LDAP, and cleartext HTTP, and established SSL VPN sessions from staging hosts including 23.240.77[.]233 and 47.18.167[.]159. Privilege escalation used a path-traversal auto-script object named ../../../../setup that dropped a staging chain under /data2/template/, including the lldprx injector, Emscripten JavaScript and WebAssembly modules, and an orchestrator that launched the implant. PEERSTITCH attaches to miglogd and iked with ptrace, maps a 16 KB RWX anonymous buffer, writes a 1,344-byte hook payload, NOP-patches three text offsets, and builds a covert cross-daemon bridge through /proc/<pid>/mem using markers such as TCP port 8550 and link-local 169.254.0.1. Separately, the operators weaponized Apache mod_md ACME renewal so DNS-01 challenges mapped to /bin/node would open an SSH reverse shell on a continuous MDRenewMode always loop.

Fortinet diagnostic log showing path-traversal auto-script object used to drop the PEERSTITCH loader.
Screenshot: Unit 42, Figure 2, Fortinet log capturing exploitation of CVE-2025-61624 to run the PEERSTITCH loader, Oct 14, 2026 (fair use).A Fortinet log captures the path-traversal auto-script that dropped the loader.
Diagram of the 16 KB RWX anonymous buffer layout used by the ARM64 PEERSTITCH implant.
Screenshot: Unit 42, Figure 5, Visual memory layout of the 16 KB buffer used by the ARM64 PEERSTITCH payload, Oct 14, 2026 (fair use).The ARM64 payload lives in a 16 KB buffer with a hook entry and a forwarding loop.

Detection guidance in the report tracks artifacts SOCs can hunt without waiting for a disk IoC: anonymous 16,384-byte rwxp regions in miglogd and iked maps, MOV X0,X0 NOP patches at documented offsets, cross-PID open and write activity against /proc/<pid>/mem, Signal 11 crashlog entries for those daemons, and system.auto-script objects whose names contain ../../ traversal. Unit 42 also documents anti-forensics that killed miglogd and syslogd, cleared crash logs, rolled back rogue admin and auto-script objects, overwrote md-acme.conf with a benign ACME comment string, and unlinked the injector binary before exit. The firm published SHA-256 hashes for the injector and staging components, network indicators for the staging and ACME hosts, and a YARA rule for the ARM64 mmap shellcode and injection prologue. One compromised management plane, Unit 42 concludes, is not contained by the MSP's own boundary: the cryptographic trust material that left with the archive remains valid until defenders rotate it on every managed device.

Sources:

Priya Shah covers threat intelligence, intrusion analysis, and adversary tradecraft for SOCtember from Singapore.

Related stories

Threat Intel desk