Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

Unit 42 investigated an intrusion campaign exploiting CVE-2024-47575, a critical vulnerability in Fortinet's FortiManager. Attackers leveraged this flaw to compromise over 500 FortiGate firewalls. The campaign deployed PEERSTITCH, a stealthy memory-resident implant compiled for ARM64 architecture. PEERSTITCH is designed to persist in memory, making forensic detection significantly more difficult. The malware targets FortiGate network devices, indicating a focus on network infrastructure compromise. The scale of the attack (500+ firewalls) suggests a well-resourced and organized threat actor. This intrusion highlights the ongoing risk of unpatched network appliances being targeted for espionage or persistent access.