PEERSTITCH malware exploits FortiManager to target FortiGate firewalls
Palo Alto Networks Unit 42 discovered the fileless PEERSTITCH implant, which leverages a FortiManager vulnerability to compromise managed FortiGate firewall processes.
Palo Alto Networks Unit 42 researchers identified the PEERSTITCH malware implant targeting FortiGate firewalls following a security breach at a telecommunications provider starting in September 2024.
Attackers gained initial access by exploiting CVE-2024-47575 to compromise a FortiManager appliance. This gave them access to configuration data for more than 500 managed firewalls. PEERSTITCH operates entirely within the memory of legitimate firewall processes instead of residing as a conventional file on the system disk. This in-memory execution bypasses traditional file-based antivirus scanning techniques that search for malicious signatures on storage media.
Active in memory, PEERSTITCH can manipulate VPN security checks, letting attackers intercept or bypass authentication mechanisms while appearing as standard network traffic. Because the implant integrates directly into authorized processes, it masks its presence from standard administrative monitoring tools.
Attackers exfiltrated configuration files and sensitive data from the FortiManager device. However, investigators have not confirmed that every one of the 500 managed firewalls was compromised by the implant. This incident shows the difficulty of identifying memory-resident threats that leave few traditional forensic artifacts behind, pointing to limitations in signature-based detection for threats operating at the process level.