PEERSTITCH Malware Exploits Unpatched FortiOS to Evade Detection via Legitimate Processes
A sophisticated threat actor chained two Fortinet vulnerabilities — CVE-2024-47575 (FortiManager) and CVE-2025-61624 (FortiOS path traversal) — to deploy a stealthy, memory-resident malware that communicates exclusively through legitimate system processes and initiates no outbound connections, making traditional detection nearly impossible. The root cause is a failure to promptly patch critical network infrastructure, compounded by insufficient behavioral monitoring capable of detecting anomalous process communication patterns. This matters because network security appliances like VPN gateways sit at the perimeter and, when compromised, grant attackers privileged access to credentials, configurations, and internal network segments. The campaign demonstrates that unpatched edge devices are high-value targets for advanced persistent threat actors who increasingly rely on living-off-the-land techniques to remain undetected for extended periods.
Tactical Insight
Immediate actions
- Apply Fortinet security patches for CVE-2025-61624 and CVE-2024-47575 immediately, or isolate affected FortiOS and FortiManager devices until patching is complete.
- Audit all FortiManager configurations and exported credentials for signs of unauthorized access or exfiltration from the initial CVE-2024-47575 compromise.
- Deploy integrity monitoring on FortiOS devices to detect unexpected in-memory process activity or unauthorized inter-process communications.
Detection measures
- Implement behavioral analytics (EDR/NDR) capable of identifying anomalous process-to-process communications on network appliances, even in the absence of outbound connections.
- Enable detailed logging of all VPN session activity and tagged session metadata, forwarding logs to a centralized SIEM for correlation and alerting.
- Hunt retrospectively for indicators of compromise associated with the CL-STA-0954 campaign across all perimeter and management devices.
Long-term improvements
- Establish a rapid-response patching SLA (e.g., 24–72 hours) specifically for critical internet-facing network appliances and enforce it through automated compliance checks.
- Implement strict network segmentation to isolate management planes (e.g., FortiManager) from production networks, limiting lateral movement if a device is compromised.
- Rotate all credentials and secrets stored in or accessible via FortiManager on a regular schedule, and immediately after any suspected compromise of management infrastructure.