PEERSTITCH: The Memory-Resident FortiGate Implant Exploiting CVE-2025-61624 — CISA Deadline Is Today

Your FortiGate firewall may be harbouring a ghost. While your logs show clean, a memory-resident implant called PEERSTITCH could be silently intercepting VPN sessions, tunnelling stolen data out through the ACME certificate protocol, and leaving no trace on disk. Palo Alto Networks Unit 42 made this discovery during a forensic investigation of a compromised telecommunications managed service provider — and today, October 19, 2026, is the CISA-mandated remediation deadline for the underlying vulnerability, CVE-2025-61624. If your FortiOS build is still below 7.6.5 or 7.4.10, you are running a known, actively exploited attack surface.

What Is PEERSTITCH? A Ghost in the Firewall

PEERSTITCH is not your typical malware. There is no file dropped to disk. There is no new listening port opened. There is no suspicious process that a routine ps aux or antivirus scan will catch. Instead, PEERSTITCH is a memory-resident process patcher — a 64-bit ARM64 executable that, once executed by an attacker with sufficient privilege, injects malicious code directly into the running memory of two critical FortiOS daemons:

• miglogd — the main logging and traffic visibility daemon. By patching this in memory, PEERSTITCH can selectively suppress or falsify log entries, hiding attacker activity from the SIEM, NOC dashboard, and FortiAnalyzer.
• iked — the IKE/IPsec VPN key exchange daemon. Patching iked allows the implant to intercept VPN credentials, session keys, and encrypted traffic negotiation in real time.

For command and control, the attackers weaponised Apache’s native mod_md module, which is present on FortiGate appliances and uses the ACME certificate management protocol for outbound HTTPS communication. ACME traffic on port 443 looks identical to routine certificate renewal and is rarely inspected or blocked. This is a textbook example of living-off-the-land (LotL) technique adapted specifically to the FortiOS environment — a level of platform-specific sophistication that points squarely at a well-resourced, nation-state-adjacent threat actor.

Unit 42 tracks this activity cluster as CL-STA-0954, which overlaps with UNC5820 in Mandiant’s taxonomy — an actor with prior focus on telecommunications infrastructure and critical national infrastructure targets.

CVE-2025-61624: The Path Traversal That Enables Implant Deployment

CVE-2025-61624 is a path traversal vulnerability (CWE-22) in the FortiOS command-line interface’s system.auto-script engine. An attacker who already holds an authenticated administrative session — for example, after stealing credentials via a previous FortiManager compromise — can craft malicious arguments to existing CLI commands. These arguments traverse the filesystem using ../ sequences to read or write arbitrary files as root.

The CVSS v3.1 score of 6.5 (Medium) reflects the authentication prerequisite — the attacker needs an admin account. This is precisely why the score misleads defenders: in the PEERSTITCH kill chain, administrative credentials were already obtained via CVE-2024-47575 (FortiJump), making the “requires authentication” mitigation factor meaningless. Once inside with creds, CVE-2025-61624 becomes a reliable, scriptable path to implanting PEERSTITCH in a matter of seconds.

Attribute	Detail
CVE ID	CVE-2025-61624
Fortinet Advisory	FG-IR-26-122
CWE	CWE-22 (Path Traversal)
CVSS v3.1	6.5 Medium (NVD) / 6.0 (Fortinet)
Affected Products	FortiOS 7.6.0–7.6.4, 7.4.0–7.4.9, 7.2.x, 7.0.x, 6.4.x; FortiProxy; FortiPAM; FortiSwitchManager
Fixed Builds	FortiOS 7.6.5+, 7.4.10+, 8.0.0+
CISA KEV Added	October 16, 2026
Federal Remediation Deadline	October 19, 2026 (TODAY)
Exploitation Status	Confirmed in the wild (Unit 42 / Fortinet PSIRT)

The Full Kill Chain: FortiJump → PEERSTITCH

Understanding PEERSTITCH in isolation misses the bigger picture. The Unit 42 investigation revealed a two-stage attack chain against a telecommunications managed service provider:

1. Stage 1 — FortiManager Compromise (CVE-2024-47575 / “FortiJump”): The attacker exploited this critical pre-authentication RCE in Fortinet FortiManager to gain full control over a management console overseeing hundreds of client networks. From this single foothold, they exfiltrated configurations, credentials, routing tables, and network architecture data for more than 500 managed FortiGate firewalls.
2. Stage 2 — Privilege Escalation and Implantation (CVE-2025-61624): Armed with harvested administrative credentials, the actor then targeted individual FortiGate appliances. CVE-2025-61624 provided a reliable, scriptable method to write the PEERSTITCH binary into a specific memory location and execute it, injecting the implant into the miglogd and iked daemons.
3. Stage 3 — Long-Term Persistent Access: With PEERSTITCH in place, the attacker maintained covert, undetected access to VPN session data and suppressed logging — essentially blinding the MSP’s NOC. CISA confirmed the activity predated public disclosure of CVE-2025-61624 by over a year: the initial intrusion was traced to September 2024, but the flaw was only published by Fortinet in April 2026.

This is a sobering timeline. The attacker maintained stealth access for at least 19 months before discovery.

The India Angle: Why MSSPs and Telecom Are High-Value Targets

India’s telecommunications sector and the MSSP ecosystem serving it represent an attractive target surface. Distributed enterprise networks across banking, insurance, manufacturing, and government increasingly rely on FortiGate as the perimeter enforcement point — often managed remotely by third-party integrators with FortiManager central management. As we reported when the FBI warned about 86,644 compromised FortiGate devices, the problem of unpatched Fortinet appliances is acute — and attackers know it.

The PEERSTITCH model is particularly dangerous in this context: an attacker who compromises one MSSP’s FortiManager console inherits the keys to every client network under management. India’s regulatory frameworks (CERT-In’s 6-hour incident reporting mandate, RBI cyber hygiene circulars) create strong compliance motivations, but they mean nothing if the breach is invisible because the logging daemon itself has been compromised.

Related reading: The Gentlemen Ransomware group and its database of 14,700 FortiGate devices illustrates how systematically these actors catalogue and monetise unpatched Fortinet infrastructure in the region.

Indicators of Compromise

Because PEERSTITCH is memory-resident and fileless, traditional file-hash-based IOCs are of limited value. Unit 42 and Fortinet have shared the following forensic indicators:

• Unexpected reboots or daemon restarts of miglogd or iked without corresponding maintenance windows
• Gaps or anomalies in FortiOS traffic logs — particularly sessions with no corresponding log entry, or log files with unusual timestamp jumps
• ACME/mod_md outbound connections to unusual external IP ranges not associated with known certificate authorities (Let’s Encrypt, ZeroSSL)
• FortiManager configuration export anomalies — bulk reads of device configurations at off-hours
• Admin account logins from unusual source IPs, particularly following the FortiManager CVE-2024-47575 exposure window (late 2024–2026)
• Presence of CVE-2024-47575 in your exposure history without confirmed patch verification

What You Should Do Right Now — Sanjay Seth’s Expert Recommendation

In 30 years of network security, including thousands of FortiGate deployments across India and the Gulf, I have never seen a fileless implant of this sophistication targeting the FortiOS daemon layer specifically. Here is my prioritised response plan:

1. Inventory and patch immediately. Run get system status on every FortiGate. Any appliance running FortiOS below 7.6.5 or 7.4.10 is a live vulnerability. Upgrade to 7.6.5 or later on a 7.6 train, and 7.4.10 or later on a 7.4 train. If you are on 7.2 or older, upgrade to a supported major version. Confirm patch status against Fortinet PSIRT advisory FG-IR-26-122.
2. Audit your FortiManager security posture. If your FortiManager was exposed during the CVE-2024-47575 window, treat all managed FortiGate admin credentials as compromised. Rotate every password, revoke API tokens, and re-issue certificates. Use RBAC to enforce least-privilege admin profiles — no admin should need full read-write system auto-script privileges under normal operations.
3. Verify log integrity. Query FortiAnalyzer or your SIEM for the periods matching the PEERSTITCH intrusion window (September 2024 onward). Look for the gaps described in the IOC section above. Correlate ACME certificate traffic with known-good IP ranges.
4. Segment your management plane. FortiManager and FortiGate management interfaces should never be reachable from the internet. Use an out-of-band management VLAN, enforce jump-host access with MFA, and put a zero-trust network access policy in front of every admin console. This is non-negotiable for MSSPs managing multiple client environments.
5. Threat-hunt for PEERSTITCH signs. If you have the capability, examine running processes on FortiGate via the diagnostic CLI for anomalous memory regions attached to miglogd or iked. Fortinet’s support team can assist with firmware integrity verification for high-risk appliances.
6. Review your MSSP contracts. If a third party manages your FortiGate estate, request written confirmation of their patch status for CVE-2025-61624 and their FortiManager exposure history. The PEERSTITCH attack started at the MSP layer — your upstream vendor’s hygiene is your risk.

For a broader view of the Fortinet threat landscape and how to build a resilient patching cadence, see our earlier coverage of the FortiMail zero-day that preceded this wave of Fortinet-targeting attacks.

Frequently Asked Questions

Does patching CVE-2025-61624 remove PEERSTITCH if my device is already infected?

No. Because PEERSTITCH lives entirely in RAM, a reboot after patching will clear the in-memory implant — but only if you also rotate all compromised credentials and close the initial access vector. If the attacker retains valid admin credentials, they can simply re-deploy the implant after the reboot. Patch + credential rotation + FortiManager re-hardening must happen together.

I’m running FortiOS 7.2 which isn’t in the fixed-release list — am I affected?

Yes. FortiOS 7.2.x is listed in Fortinet’s advisory as an affected branch. Fortinet recommends migrating to the 7.4 or 7.6 train and patching to the fixed build. Running end-of-mainstream-support branches in a threat-active environment is an unacceptable risk given the current exploitation landscape targeting Fortinet products specifically.

Our FortiManager is behind a firewall and not internet-facing. Are we still at risk from CVE-2024-47575?

The exposure risk is significantly lower if your FortiManager has never had an internet-routable interface. However, supply-chain and insider pathways exist — a compromised MSSP that has legitimate VPN access to your FortiManager environment effectively bypasses your perimeter controls. Network isolation is necessary but not sufficient; zero-trust access controls and credential hygiene are equally important.

How do I check whether CISA’s KEV deadline applies to my organisation?

CISA’s Known Exploited Vulnerabilities remediation deadlines are mandatory for US federal civilian executive branch (FCEB) agencies under Binding Operational Directive 22-01. They are a strong advisory signal for all other organisations globally, including Indian enterprises with US regulatory exposure (banking, pharma, IT services). The CISA KEV catalog is public and freely searchable — cross-reference your asset inventory against it monthly.

The Bottom Line

PEERSTITCH represents the evolution of nation-state FortiGate exploitation from opportunistic credential theft to surgical, long-duration implantation. A CVSS score of 6.5 is not the right lens through which to assess this threat — the right lens is “an attacker lived inside a telecom MSP’s firewall fabric for 19 months and nobody noticed.” That is the threat model your patching cadence, your logging strategy, and your MSSP contracts need to address.

The good news: the fix exists, the IOCs are published, and the patch path is clear. The window to act was yesterday. Today, it is the CISA deadline.

---

Is your FortiGate estate patched, segmented, and monitored — or is PEERSTITCH already in residence? Sanjay Seth and the P J Networks team conduct FortiGate security audits, firmware-upgrade assessments, and zero-trust architecture reviews for enterprise and MSSP clients across India. Book a no-obligation security assessment today.