PRIVACY & SECURITY
Patching Won’t Remove This One: Memory-Resident Malware Now Lives Inside Fortinet VPN Appliances
The first three breaches this month were flaws you could patch. This one is different. Researchers found malware living entirely in the memory of corporate firewalls, invisible to every conventional check, and it touches the VPN sessions themselves.
✓How the implant works✓Why patching is not enough✓The separation answer
Quick Answer
Palo Alto’s Unit 42 revealed on October 14 that attackers planted a memory-resident implant called PEERSTITCH inside Fortinet FortiGate firewalls at a telecom provider. It leaves no file on disk, opens no ports, and patches the VPN daemon’s memory so tagged sessions skip security checks. HomeIPVPN notes this is the fourth corporate remote-access compromise this month, and the first where the standard advice of “just patch” does not fully apply.
- Initial access came through FortiManager flaw CVE-2024-47575, exposing 500+ firewall configurations
- The implant runs only in RAM and communicates through legitimate process traffic
- Unit 42 attributes it to cluster CL-STA-0954, described only as a suspected advanced threat actor
Every breach in this month’s series has come with the same reassuring footnote: patch your systems and the danger passes. This one does not offer that comfort.
Palo Alto Networks’ Unit 42 published research on October 14 describing PEERSTITCH, a novel implant its investigators found running inside Fortinet FortiGate firewalls at a telecommunications managed service provider. The intrusion itself began in September 2024, but the findings are new, and they describe something worse than a vulnerability. They describe an occupant.
The attackers, tracked as cluster CL-STA-0954 (also known as UNC5820), started by exploiting CVE-2024-47575, a critical FortiManager flaw nicknamed FortiJump, to register a rogue virtual appliance and exfiltrate an archive containing the running configurations, credentials, and cryptographic material for more than 500 managed FortiGate firewalls. Unit 42 confirmed the stolen credentials were recoverable, and the attackers used them to establish unauthorized VPN sessions with legitimate logins.
How the implant works
From there, the attackers exploited a second flaw, CVE-2025-61624, a path traversal in the FortiOS auto-script engine, to escalate from administrative access to root on the firewall’s underlying operating system. That opened the door for PEERSTITCH itself: a 64-bit ARM64 program that attaches to two running FortiOS daemons, the logging service miglogd and the VPN service iked, and patches their memory while they run.
What it does not do is as important as what it does. It writes no binary to disk. It opens no listening ports. It starts no outbound connections of its own. Instead, it inspects traffic already flowing through the infected daemons, looking for two markers, and when it finds a tagged session, the patched VPN daemon takes an alternate code path that skips FortiOS security validations. The attacker’s session gets handled as a legitimate one, by the firewall’s own code.
The attackers also set up a separate command channel by abusing the Apache mod_md module for an SSH reverse shell, and they wiped logs along the way. Unit 42 describes the tradecraft as overlapping with suspected nation-state operations, though it stops short of naming a state actor.
Why patching is not enough
Here is the part that breaks the usual playbook. A memory-resident implant does not live in any file a patch would replace. Updating FortiOS changes the code on disk; the malicious patches live in the running memory of processes that started before the update. Standard advice assumes the compromise is a flaw in the software. This compromise is a guest in the software’s head.
That distinction matters for everyone downstream of these appliances. A FortiGate sits in the path of the traffic it protects. It terminates VPN sessions, which means encrypted tunnels end at the box, and the box sees what is inside. When the box itself is compromised at the daemon level, the usual guarantees of the tunnel no longer hold for traffic passing through it. As SC Media’s coverage notes, the malware is specifically built to resist conventional endpoint and network detection.
This is also the fourth distinct compromise of corporate remote-access infrastructure this month, after GlobalProtect, Ivanti, and BeyondTrust. The first three were flaws in the gate. This one is something living behind the gate, in the walls.
The separation answer
The lesson compounds rather than changes. You cannot audit the memory of your employer’s firewall. You cannot verify that a patch evicted an implant that was designed to survive exactly that. You cannot see the sessions the appliance handles on its own behalf. The infrastructure belongs to someone else, and the risk now includes compromises that outlive the fix.
What you can do is keep your personal traffic somewhere the employer’s appliance never sees it. Banking, personal email, payments, and everything tied to your identity should travel through your own residential connection, where no vendor implant on someone else’s firewall can intercept it. Four breaches in a month, each worse than the last, make the same point: separation is not a preference. It is the only control you actually own.
