Unit 42 links MSP intrusion of telecommunications with PEERSTITCH in memory and Fortinet

Palo Alto Networks Unit 42 researchers have linked an intrusion directed against a managed telecommunications service provider to a chain of attacks that culminated in the implementation of a resident memory malware for Linux ARM64 called PEERSTITCH. According to the analysis, the attackers combined the prior commitment of a centralized management console with the exploitation of a failure in the Fortinet product command interpreter to insert code directly into the memory of legitimate processes, thus avoiding obvious disk artifacts and network connections.

Confirmed facts: Unit 42 describes that the campaign, traced as CL-STA-0954 / UNC5820, began with the exploitation of the vulnerability known as FortiJump (CVE-2024-47575) against a FortiManager in September 2024, which allowed the exfiltration of configurations, databases and cryptographic material of more than 500 FortiGate managed. The attackers subsequently abused a traversal path vulnerability (CVE-2025-61624, CVSS 5.4 score) in the command interpreter of several Fortinet products - parched by Fortinet in April 2026 - to deploy PEERSTITCH. The Unit 42 technical report summarizes these observations and implementation techniques; available on the Unit 42 site for additional details https: / / unit42.paloaltonetworks.com /. Fortinet posted ads and patches on its product safety portal https: / / www.fortinet.com / support / product-security / security-advices.

Technically, PEERSTITCH is an ARM64 native binary written in C that is deployed by an orchestrator that downloads several components (JavaScript / WebAssembly modules and a native "core"). The critical stage does not leave persistent binaries: a native injector is attached to two demons of FortiOS - miglogd and iked - and modifies its operating memory space. The reported method uses ptrace with execution interruption (PTRACE _ INTERRUPT), assigns executable pages, writes malicious code and redirects the process execution to that injected code. The result is a covert communication door between legitimate processes which allows attackers to mark and recognize specific VPN sessions to skip controls and maintain discreet access. For technical context on ptrace and how to handle running processes, see the system documentation: https: / / man7.org / linux / man-pages / man2 / ptrace.2.html.

The implementation described includes marks embedded in the traffic processed by miglogd (for example, an identifier containing a port reference "8550" and the chain "169.254.0.1" as a pattern; these are not open ports or assigned addresses, but symbols in traffic). When iked process VPN sessions, look for those identifiers and take alternative execution routes that evade normal validations. In addition, the attackers reportedly used Apache native modules in FortiGate to establish a command and control channel based on SSH and came to supplant the FortiManager console to extract configurations from managed devices.

What is confirmed is the technical methodology and goals: exfiltration of sensitive material (configurations, keys and databases), establishment of hidden persistence in memory, and abuse of trust in central management. What remains estimate or open to verification is the final identity of the actor and if other specific vulnerabilities were exploited to achieve certain phases of the attack; Unit 42 mentions other possible failures, but points to additional requirements for registration in FortiCloud for exploitation in certain vectors.

Practical consequences: The combination of access to configurations and keys with a memory implant allows attackers to create unauthorized VPN sessions, intercept encrypted traffic, and move within internal networks without leaving easy track on disk or on conventional network controls. The exposure of certificates and private keys compromises the cryptographic confidence of entire perimeters and requires intensive response actions (certificate rotation, key reissue, VPN session review). In addition, the handling of records and the removal of artifacts - the completion of syslog, the deletion of drop records, the automatic removal of administrative accounts and self-script objects - complicates forensic investigation.

Concrete and immediate recommendations for managers and companies that use Fortinet or depend on managed suppliers: park all affected Fortinet devices as soon as possible and apply the updates published by the manufacturer (FortiOS, FortiManager, FortiPAM, FortiProxy, FortiSwitchManager). It makes a commitment where there are exposed management consoles: respond to incidents that include acquisition of volatile memory of potentially affected machines, forensic memory analysis and cleaning or reinstallation of compromised applications. Private and certified keys that have been stored in FortiManager or exported by the attacker; revoke and reissue administrative and VPN credentials. Restrict access to management consoles with access controls with white list of IP, MFA and network segmentation.

For operational detection and mitigation, consider immediately activating and reviewing process integrity and system call audit that detect ptrace or unusual memory changes; deploy specific rules in EDR to monitor critical process modification (miglogd, iked and equivalent) and monitor anomalies in log generation or record telemetry. Look for indicators such as removal of autoscript objects or newly created and deleted administrative accounts, as well as patterns on payloads that could contain the above-mentioned marks, even if their detection is complex because they hide within legitimate traffic.

If you are the final client of a managed service provider, ask for evidence of the integrity of the central manager who manages your perimeter (management logs, update records and account audits). Consider conducting independent certificates configuration and management audits. In cases of suspicion, coordinate with an incident response team and, where appropriate, with the authorities responsible for managing gaps.

In short, this intrusion illustrates the added risk of centralizing edge management: a single compromised point can convert configurations and secrets into a lever to compromise multiple networks. The technique of memory injection and covert communication between legitimate processes significantly increase the traditional detection difficulty. Immediate parking, cryptographic material rotation and forensic memory analysis are non-optional steps for any affected organization or with Fortinet devices exposed.