How PEERSTITCH Implant Hides in FortiGate Memory Without Files or Ports

PEERSTITCH is a memory-resident ARM64 implant designed to operate silently within FortiGate firewalls. According to Unit 42 research shared with GBHackers, the malware hijacks legitimate operating-system processes instead of installing new software. It leaves no persistent executable files on disk, opens no listening network ports, and initiates no outbound connections itself, making traditional signature-based detection ineffective.

How does the implant evade standard detection?

The malware relies on process injection rather than file persistence. Researchers noted that the injector, named lldprx, targets specific system binaries such as /bin/miglogd for logging and /bin/iked for IKE/IPsec negotiations. Once the code executes and establishes its foothold within these legitimate processes, the injector deletes its own executable from the disk. This clean-up step ensures that forensic scans looking for unknown binaries will find nothing, as the malicious code resides only in the active memory of trusted system services.

Which vulnerabilities enabled this intrusion?

The attack chain began in September 2024 with initial access via CVE-2024-47575, known as FortiJump. This missing-authentication flaw allowed attackers to register a rogue virtual appliance on the management channel at TCP port 541. They then exfiltrated configuration archives containing network topology and encrypted credentials. Later, deployment of the PEERSTITCH implant relied on CVE-2025-61624, a path-traversal vulnerability in Fortinet’s command-line interpreter that permitted execution with root-level privileges.

What data and access did attackers steal?

Unit 42 confirmed that stolen configuration archives contained administrative databases, certificates, and private keys. Researchers determined that administrative and SSL/VPN passwords were recoverable from this material. Attackers used these credentials to establish unauthorized VPN sessions from external infrastructure. They also pushed packet-capture configurations to managed firewalls to intercept HTTP traffic and monitor authentication protocols like RADIUS and LDAP, facilitating further internal reconnaissance and credential theft.

What steps should administrators take now?

Administrators managing Fortinet infrastructure should verify that devices are patched against CVE-2024-47575 and CVE-2025-61624. Review FortiManager configurations for unauthorized virtual appliances or unusual serial numbers. Monitor for unexpected packet-capture rules or outbound VPN sessions originating from managed devices. Check process memory for anomalies in miglogd and iked services, as these are known targets for this specific injection technique.

What analysts watch for

Security teams investigating memory-resident implants should focus on behavioral anomalies rather than file hashes. Analysts usually examine process integrity to detect code injection into trusted system binaries. They check for unexpected memory allocations within logging or networking services. Teams also review network logs for configuration changes that enable passive monitoring, such as sudden packet captures. Persistence mechanisms that avoid disk writes require deep memory forensics and behavioral correlation to identify effectively.

Background: Memory forensics

Memory forensics is the analysis of a computer’s random access memory to detect hidden threats. Because many modern attacks leave no trace on the hard drive, examining RAM reveals active processes, network connections, and decrypted data that disk-based tools miss entirely.

Read the full guide: Memory Forensics: Extracting Hidden Malware from RAM

What to do and how to stay safe: PEERSTITCH

• Audit FortiManager and FortiGate consoles for unauthorized virtual appliances or rogue serial numbers.
• Inspect packet-capture configurations on managed firewalls for rules targeting sensitive authentication traffic.
• Monitor process memory of critical system services for anomalous code execution or size changes.
• Verify that all management interfaces enforce strict authentication to prevent missing-auth exploits.

Step-by-step guide: How Windows Malware Removal Works: The Hidden Persistence Layer

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is PEERSTITCH a file-based virus?

No, PEERSTITCH is a memory-resident implant that deletes its loader after execution, leaving no persistent executable on disk.

Which CVEs are associated with this campaign?

The intrusion used CVE-2024-47575 for initial access and CVE-2025-61624 to deploy the memory implant.

Did this affect customer networks directly?

Researchers did not investigate customer networks or confirm downstream compromises during this investigation.