CL-STA-0954 Deploys PEERSTITCH Malware on FortiGate Firewalls After FortiManager Breach
Do Son 
Image: Unit 42
At a Glance
| Malware Family | PEERSTITCH malware (64-bit Linux ARM64 in-memory process injector) |
| Threat Actor | Confirmed as cluster CL-STA-0954 (tracked by Mandiant as UNC5820); suspected nation-state overlap |
| Target / Victims | 1 telecommunications managed service provider and configuration data for over 500 managed FortiGate firewalls |
| Delivery Vector | FortiManager CVE-2024-47575 (FortiJump) remote command execution followed by FortiOS CVE-2025-61624 auto-script path traversal |
| Key Capabilities | Process memory patching, cross-daemon covert IPC, Apache mod_md ACME reverse shell, FGFM management impersonation |
| Sources | Palo Alto Networks Unit 42, Google Cloud Mandiant, and Fortinet PSIRT advisories |
TL;DR
Threat cluster CL-STA-0954 breached a telecommunications provider in September 2024 by exploiting CVE-2024-47575 on a central FortiManager server. From that single appliance, the attackers stole configuration files and keys for over 500 managed FortiGate firewalls. Subsequently, the intruders exploited a second flaw to deploy PEERSTITCH malware into firewall memory.
Delivery and Attribution
The attack began when intruders sent crafted requests over TCP port 541 to exploit CVE-2024-47575, also called FortiJump. This missing authentication flaw carries a critical CVSS score of 9.8. Using this access, the actors registered a rogue virtual FortiGate device to the central FortiManager server. Immediately afterward, they generated and stole a hidden archive containing SQLite databases, private keys, and configurations for over 500 downstream firewalls. Google Cloud Mandiant, which tracks this group as UNC5820, observed similar FortiManager attacks starting on June 27, 2024. Fortinet later patched the flaw, and CISA added it to the Known Exploited Vulnerabilities catalog in October 2024.
Confirmed Versus Suspected Attribution
According to the Unit 42 research report, analysts track this activity under the confirmed cluster name CL-STA-0954. Meanwhile, suspected attribution links the post-exploitation tradecraft to nation-state actors due to their deep knowledge of FortiOS internals. However, neither Unit 42 nor Mandiant has linked the campaign to a specific country. Furthermore, while the stolen archive covered over 500 internal and client firewalls, Unit 42 noted that its investigation examined only the provider’s own network.
Infection Chain
After an initial waiting period, CL-STA-0954 used the compromised FortiManager server to push packet-capture rules to downstream firewalls. Specifically, the attackers monitored unencrypted HTTP traffic and 11 TCP ports alongside LDAP, RADIUS, and TFTP traffic. At the same time, the actors cracked reversible password hashes stored inside the stolen FortiGate configuration files. Using those recovered credentials, the intruders opened valid SSL/VPN sessions into internal management segments.
Privilege Escalation and Process Injection
Because standard FortiOS administrator accounts lack root shell access, the attackers exploited CVE-2025-61624 in the auto-script engine. By placing directory traversal sequences in the script name, they wrote files outside the intended folder as root. Next, the script downloaded five staging files, including JavaScript modules, a WebAssembly binary, and the 64-bit ARM64 PEERSTITCH malware injector.
Once launched, the FortiOS PEERSTITCH malware acts as a one-shot injector targeting the logging daemon and the IPsec VPN daemon. First, it attaches to both running processes via system debugging calls and pauses their execution. Second, it allocates a 16-kilobyte read-write-execute memory buffer inside each daemon. Finally, the tool patches three memory offsets to disable tamper checks, redirects execution into the hook buffer, and deletes its disk files.
Command-and-Control and Data-Exfiltration Behavior
Rather than opening network sockets, the implant hides inside normal firewall operations. As Unit 42 researchers wrote, “PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections.” Furthermore, the report states, “Instead, it communicates through traffic generated by legitimate processes on the infected host, which makes the malware resistant to conventional endpoint and network detection.” Specifically, the injected hooks build a covert inter-process communication bridge between the logging service and the VPN daemon. When the logging service spots a specific port or link-local IP marker, it extracts a 31-byte session tag. Next, the hook writes that tag directly into the VPN daemon’s memory, prompting the VPN service to bypass security validations.
Fallback Channel and Management Impersonation
In addition, CL-STA-0954 built a fallback channel by abusing the native Apache domain management module on FortiGate firewalls. The attackers mapped DNS certificate validation challenges directly to the system Node.js runtime. Whenever Apache ran a certificate renewal check against the attacker’s server, it executed shell commands hidden in the domain field. Consequently, this polling loop maintained an outbound SSH reverse shell. Additionally, the actors impersonated the central FortiManager server over TCP port 541 using an unprovisioned cloud administrator account to pull configurations from other firewalls.
Defense and Detection Guidance
The attackers used several anti-forensic methods to hide their tracks. Before running scripts, they stopped logging daemons, cleared diagnostic crash logs, and overwrote the rogue Apache configuration with decoy text. Because FortiOS PEERSTITCH malware leaves no files on disk, defenders must hunt for anomalies in volatile memory. Specifically, administrators should inspect the memory maps of the logging and VPN daemons for anonymous 16-kilobyte executable buffers. Security teams should also audit system calls for cross-process memory writes and check configuration logs for traversal strings.
However, patching CVE-2024-47575 and CVE-2025-61624 alone will not evict the intruders. Unit 42 warned that “The cryptographic trust material governing the platform’s relationship with every managed device leaves with the attacker and remains valid until it is rotated.” Therefore, defenders must treat all credentials, private keys, and certificates from a breached FortiManager server as compromised. Finally, organizations must isolate management ports, block unknown device registrations, and rotate all keys and passwords across every managed firewall.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
