The deployment of PEERSTITCH malware relied on a path traversal vulnerability in the FortiOS system-auto-script feature to achieve root-level access on target firewalls. This sophisticated operation, identified under the tracking designation CL-STA-0954, marks a significant evolution in the methodology used by modern threat actors to target critical network infrastructure. By focusing on the centralized management layer rather than individual perimeter devices, the attackers successfully transformed a single entry point into a master key for an entire telecommunications network. This trend of living-off-the-edge emphasizes the growing vulnerability of management consoles that maintain elevated privileges across diverse enterprise environments. The intrusion demonstrated a calculated progression where the compromise of the FortiManager platform provided the necessary visibility to map downstream assets and prepare for a deep, persistent infection. As network architectures become increasingly centralized to manage thousands of edge nodes, the risks associated with these hubs have reached a critical threshold, requiring a fundamental shift in how organizations defend their core management plane.
Initial Access and the Exploitation of Management Protocols
The breach was initiated through the exploitation of a critical vulnerability in the FortiGate to FortiManager protocol, known technically as the FGFM channel. This specific flaw, tracked as CVE-2024-47575, allowed unauthenticated remote attackers to send specially crafted requests to the management appliance, effectively bypassing standard authentication handshakes. During the early stages of the intrusion, the threat actors successfully registered a rogue device to the FortiManager system. This was not merely an attempt to join the network but a strategic maneuver to gain a foothold within the management database. By impersonating a legitimate managed device, the attackers were able to interact with the server’s internal file system and prepare for the massive exfiltration of sensitive organizational data. This stage of the attack highlights the inherent trust placed in management protocols, which often lack the granular inspection applied to standard user traffic, providing a quiet path for sophisticated adversaries to establish a presence.
Once the rogue registration was finalized, the threat actors moved quickly to exfiltrate a comprehensive archive containing the configuration files for more than five hundred managed FortiGate firewalls. This stolen archive functioned as a tactical roadmap, revealing the internal architecture of the target’s entire global network. It contained exhaustive details such as public and private IP addresses, complex network routing tables, and the specific firewall rules governing traffic flow between sensitive zones. Most critically, the configurations included encrypted administrative credentials and the cryptographic certificates used to establish secure tunnels. By obtaining this data, the attackers were no longer operating in the dark; they possessed the exact specifications needed to impersonate administrators and navigate the internal network without triggering traditional signature-based alerts. This theft represented a total compromise of the network’s blueprint, allowing the adversary to plan subsequent phases of the operation with a high degree of precision and minimal risk of immediate discovery.
Strategic Intelligence and Internal Network Infiltration
Following the acquisition of the configuration archive, the threat actors entered a phase of processing and intelligence recovery. Using advanced decryption techniques, they were able to extract administrative and VPN passwords that were stored within the configuration files. This capability allowed the operation to transition from a localized compromise of the management server to a distributed attack across the enterprise’s edge infrastructure. By utilizing the recovered credentials, the attackers established unauthorized VPN sessions that granted them direct access to internal segments typically isolated from the public internet. This maneuver demonstrated the cascading failure that occurs when a centralized management hub is compromised, as the trust established between the hub and its nodes is immediately weaponized against the organization. The ease with which the attackers pivoted from data theft to active network infiltration underscores the critical importance of protecting management plane credentials with hardware-based authentication.
To deepen their visibility into the telecommunications provider’s internal operations, the threat actors leveraged the FortiManager platform to push unauthorized packet-capture settings to specific downstream firewalls. These captures were strategically configured to monitor unencrypted protocols and sensitive directory services, including LDAP, RADIUS, and TFTP. By intercepting these communications at the firewall level, the attackers were able to harvest a continuous stream of authentication data, internal file transfers, and directory activity. This passive monitoring technique provided a wealth of secondary intelligence, including user account details and internal system names, which were later used to refine their targeting. The use of a legitimate management feature to facilitate unauthorized surveillance is a hallmark of high-maturity threat actors, as it blends malicious activity with routine administrative tasks. This approach ensures that even if the packet captures are noticed, they may be dismissed as part of a troubleshooting exercise by overextended security personnel.
Root Level Escalation and Technical Malware Execution
The operation entered a more invasive stage with the exploitation of a second vulnerability found within the FortiOS operating system. This path traversal flaw, designated as CVE-2025-61624, resided in the system-auto-script feature, which is traditionally used by administrators to schedule maintenance tasks. By utilizing their stolen administrative credentials, the threat actors were able to bypass directory restrictions and write malicious files to sensitive areas of the system. Because these auto-scripts are executed with root-level privileges, the attackers successfully broke out of the restricted management shell and gained full control over the underlying Linux-based kernel of the target firewalls. This escalation was a necessary prerequisite for the deployment of their specialized malware suite, as it provided the permissions required to manipulate system memory and alter core OS processes. This phase illustrates the danger of features that allow script execution, as they represent a powerful lever for attackers who have already secured administrative access.
The centerpiece of the technical deployment was a stealthy ARM64 executable known as lldprx, which served as the primary injector for the PEERSTITCH malware. This component was designed to operate entirely within the system memory to avoid detection by traditional disk-based security scanners. Upon execution, the injector targeted two vital FortiOS daemons: the logging process and the VPN handler. By attaching to these specific processes, the malware was able to intercept and manipulate traffic as it was being processed by the firewall’s hardware. PEERSTITCH utilized cross-process memory communication to pass session tags between these daemons, allowing the attackers to identify specific VPN traffic markers. When these markers were triggered, the malware executed alternate code paths that bypassed standard security checks, effectively creating hidden ghost sessions. These backchannels allowed the threat actors to maintain remote access that was completely invisible to the firewall’s internal logging and auditing mechanisms, ensuring a high level of operational stealth.
Sustained Persistence and Operational Security Recovery
To ensure long-term access that could survive reboots and system updates, the attackers established a secondary command-and-control channel by subverting the Apache mod_md module. This module is typically reserved for the automated management of certificates through the ACME protocol, making its traffic appear routine and legitimate to most monitoring tools. The threat actors modified the configuration so that validation requests would instead trigger malicious commands via Node.js. This allowed the compromised firewalls to communicate with attacker-controlled infrastructure under the guise of automated certificate renewal traffic. By embedding a reverse shell within this modified system service, the adversary maintained a persistent bridge into the network that did not rely on the volatility of the memory-resident PEERSTITCH implant. This dual-track strategy, which combined stealthy memory patching with persistent service manipulation, highlights the meticulous planning required to maintain a presence in hardened network environments over an extended period.
The incident involving the PEERSTITCH malware underscored the fragility of centralized management architectures when faced with determined adversaries. Security teams were required to move beyond traditional perimeter defense mindsets, adopting a more aggressive stance on internal auditing and credential hygiene. The primary takeaway from this campaign was the necessity of immediate, comprehensive secret rotation following any suspected management breach, as attackers demonstrated high proficiency in decrypting stored configurations. Organizations found that the most effective response involved the implementation of hardware-backed identity management and the use of dedicated forensic tools to monitor process memory for unauthorized patches. Furthermore, the event highlighted the importance of limiting the scope of auto-scripting features and enforcing strict isolation for management protocols. Moving forward, the focus shifted toward a zero-trust model where management servers were treated with the same scrutiny as external-facing assets, ensuring that no single compromise could lead to a network-wide failure.
