PeerStitch, Part by Part: How a Memory-Only Implant Hid Inside FortiGate Firewalls Without Opening a Single Port
Palo Alto Networks has detailed PeerStitch, a FortiGate implant that lives only in memory and talks through the firewall’s own traffic. CISA has added one of the Fortinet flaws involved to its exploited-vulnerabilities list. Here is the implant broken down into its parts, and what defenders can still see.
Firewalls sit at the edge of the network precisely so that everything else can trust them. That is what makes PeerStitch worth understanding: it is a piece of malware designed to live inside FortiGate firewalls, leave as little trace as possible and never draw attention by opening its own connections. Researchers say a suspected state-backed group used it after breaking into a telecommunications company.
SecurityWeek summarized the new Palo Alto Networks research, which ties the implant to a group tracked as UNC5820 (CL-STA-0954 in Palo Alto’s naming). Below is the operation taken apart piece by piece.
Part 1: The way in
The intrusion, which researchers date to September 2024, began with FortiJump (CVE-2024-47575), a critical remote code execution flaw in FortiManager, the console that manages fleets of FortiGate firewalls. Fortinet patched it as a zero-day in October 2024, and Mandiant reported at the time that UNC5820 had been exploiting it since at least June 2024.
Part 2: The master key
From the central FortiManager, the attackers registered a rogue virtual FortiGate and pulled out a configuration archive describing FortiManager itself, more than 500 managed FortiGate firewalls and the victim’s network. Control of the management console became a map of the whole estate.
Part 3: The root shell
To get beneath the firewall’s normal protections, the group used CVE-2025-61624, a path traversal flaw that lets an authenticated attacker write or delete arbitrary files. It affects FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, was patched in April 2026 and was flagged by Fortinet as exploited when it was disclosed. Palo Alto believes UNC5820 used it as a zero-day to gain root on the underlying operating system and drop a script that launched PeerStitch. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Friday.
Part 4: The hiding place
PeerStitch is written in C for ARM64 hardware and stays in memory, avoiding files on disk that investigators could find later. It works as a one-shot injector: it patches the memory of running FortiOS processes, specifically the central system and traffic-logging services and the IKE/IPsec VPN service, and then gets out of the way.
Part 5: The whisper channel
Instead of opening a listening port or calling out to the internet, the implant builds a hidden bridge between those processes inside memory and communicates through traffic that legitimate firewall processes already generate. That design is also how it sidesteps default FortiOS security checks.
Part 6: The disguise and the cleanup
The attackers also pretended to be FortiManager in the management protocol (FGFM) that firewalls use to take orders, which let them send commands from their own infrastructure. Palo Alto says they did this either by knocking the real FortiManager offline through CVE-2024-26008 or by reusing secrets they had stolen. They then went to considerable lengths to wipe forensic evidence.
What defenders can still see
- Patch status: FortiManager and every affected Fortinet product should be on releases that address the three CVEs named in the research: CVE-2024-47575, CVE-2024-26008 and CVE-2025-61624.
- The management plane: unexpected devices registered in FortiManager, especially virtual FortiGates nobody ordered, and management sessions that drop or reconnect without explanation.
- Secrets: if a FortiManager was ever exposed to FortiJump, assume its configuration and stored credentials were copied and rotate them.
- Memory, not disk: because PeerStitch avoids files on disk and makes no connections of its own, a file scan or a check for open ports is unlikely to reveal it. If you suspect a device, involve Fortinet support or an incident response team rather than relying on routine checks.
Palo Alto’s own takeaway is that edge-device malware is maturing: avoiding disk artifacts and hiding communications inside process memory let the attackers stay in place while slipping past traditional monitoring.
What this means for your company
You do not need to be a telecom company for this to matter. Firewalls and their management consoles are now prime targets because few businesses watch them as closely as laptops or servers. Keep the management interface off the internet, patch edge devices on the same urgent schedule as anything on CISA’s exploited list, send firewall logs somewhere the firewall itself cannot alter, and review who and what is registered to your management console at least monthly. If an outside provider manages your firewall, ask them when these three CVEs were addressed on your equipment.
Need help reviewing your firewall patch levels, management access or log monitoring? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
