The emergence of specialized malware targeting edge infrastructure has redefined the perimeter of corporate security, forcing a reevaluation of how centralized management tools are protected from sophisticated adversaries. In a recent campaign identified by cybersecurity analysts, a threat group designated as CL-STA-0954 orchestrated a meticulous infiltration of a telecommunications managed service provider. This operation was not a mere opportunistic strike but a strategic maneuver designed to compromise the Fortinet FortiManager platform, which serves as the nervous system for hundreds of downstream firewalls. By successfully subverting this central hub, the attackers bypassed traditional perimeter defenses, granting themselves unprecedented visibility and control over a sprawling network environment. This shift toward living-off-the-edge techniques underscores a dangerous trend where management consoles, often possessing elevated privileges and broad access, become the primary targets for actors seeking long-term persistence in complex enterprise networks.
The Initial Compromise: Exploitation of the FortiJump Flaw
The intrusion commenced with the exploitation of a critical vulnerability in the FortiManager platform, designated as CVE-2024-47575 and often referred to as FortiJump. This specific flaw exists within the FortiGate to FortiManager protocol, which is the dedicated management channel that facilitates communication between the central server and the edge devices. The vulnerability allowed an unauthenticated remote attacker to send specially crafted requests through this channel, resulting in the unauthorized execution of commands on the management appliance. By leveraging this entry point, the threat actors were able to register a rogue device into the management system, effectively tricking the console into treating the attacker-controlled machine as a legitimate part of the managed network fabric. This registration was the critical first step that allowed the actors to establish a persistent bridgehead for subsequent data exfiltration operations.
Once the rogue device was integrated into the FortiManager environment, the attackers focused their efforts on gathering high-value intelligence from the connected firewalls. They successfully created and exfiltrated a comprehensive archive containing the configuration files for more than five hundred managed FortiGate appliances. This archive was an intelligence goldmine, as it included highly sensitive data such as device serial numbers, public IP addresses, internal routing tables, and complex firewall rules. More importantly, these configuration files contained encrypted administrative credentials and cryptographic certificates used to verify the trust relationship between the management server and the edge devices. By stealing this data, the attackers obtained a complete blueprint of the target’s network architecture and the keys necessary to expand their access. This phase demonstrated a high level of operational patience as the actors prepared for the next stage of the attack.
Elevating Access: Path Traversal and OS-Level Control
Following the theft of the configuration data, the threat actors shifted their focus toward individual firewalls, leveraging the intelligence they had gathered to deepen their penetration. They utilized a second vulnerability, CVE-2025-61624, which is a significant path traversal flaw found within the FortiOS system auto-script feature. This feature is traditionally used by network administrators to schedule routine maintenance tasks or automate configuration changes across the fleet. However, the vulnerability permitted an authenticated administrator—a role the attackers were able to assume using the credentials recovered from the stolen configuration files—to write files outside the intended directories. This capability was critical because it allowed the actors to bypass the restricted administrative shell and interact directly with the underlying Linux-based operating system that powers the firewalls.
By successfully exploiting the path traversal vulnerability, the attackers were able to plant a specialized loader onto the target devices. Because the auto-script service operates with root-level privileges, the commands executed by the attackers were not subject to the typical security restrictions of the management interface. This allowed the threat actors to gain full control over the system kernel and process memory, enabling the deployment of complex payloads that would otherwise be blocked by the device’s firmware protections. The use of a multi-stage loading process highlights the sophistication of the campaign, as it allowed the attackers to verify the environment before delivering the core malware components. This bridge from the administrative interface to the underlying operating system was essential for the successful injection of the PEERSTITCH implant into the most sensitive processes.
Stealth by Design: Memory Injection and Process Hijacking
The centerpiece of the technical deployment was a stealthy ARM64 executable named lldprx, which has been identified by researchers as the PEERSTITCH malware. The deployment of this implant was handled through an intricate series of scripts utilizing Node.js and WebAssembly, designed to ensure that the malware remained as elusive as possible. To avoid detection by traditional disk-based security scanners, PEERSTITCH was engineered to operate primarily within the system memory of the hijacked device. The injector component targeted two critical FortiOS daemons: miglogd, which is responsible for system logging, and iked, the daemon that manages Internet Key Exchange and IPsec VPN functions. By attaching to these specific processes, the malware could hide its activities within the noise of legitimate system operations, making it extremely difficult for standard monitoring tools to identify the breach.
Upon successfully attaching to the targeted daemons, the PEERSTITCH injector carved out anonymous sixteen-kilobyte memory regions with read, write, and execute permissions. It then patched the execution flow of the legitimate system processes to incorporate its own malicious logic. This allowed the malware to intercept and manipulate the network traffic processed by the firewalls in real-time. A particularly sophisticated feature of PEERSTITCH was its use of cross-process communication to share session markers between the logging and VPN daemons. When certain traffic patterns were identified, the malware could trigger hidden code paths that bypassed standard authentication and security checks. This created a ghost session within the firewall, providing the attackers with a covert backchannel that was entirely invisible to the administrative logs, effectively granting them a permanent and undetectable door into the network.
Long-Term Presence: Persistent Command and Control Channels
To ensure that their access remained resilient against system reboots or partial remediation, the threat actors established a secondary command-and-control channel by subverting a legitimate system module. They specifically targeted the Apache mod_md module, which is typically used for the automated management of cryptographic certificates. The attackers modified the configuration of this module so that standard certificate validation requests would instead trigger the execution of malicious commands via Node.js. This allowed the firewall to contact attacker-controlled infrastructure under the guise of routine certificate renewal traffic, ensuring the communication blended in with expected network behavior. By embedding a reverse shell within this process, the actors guaranteed a reliable way to regain access even if their memory-resident implants were discovered or if the management connection was severed.
The investigation into this campaign revealed that the attackers prioritized anti-forensic activities to maintain their operational security throughout the intrusion. They routinely disabled logging services before performing sensitive actions and meticulously cleared any crash logs that might have resulted from the memory injection process. Furthermore, the PEERSTITCH injector was programmed to delete its own binary from the disk immediately after a successful injection, leaving no trace of the malware outside of volatile memory. Organizations were urged to adopt a more proactive posture by conducting deep audits of management logs and rotating all cryptographic secrets and administrative passwords. The move toward memory-level forensics and the verification of system process integrity became the primary recommendations for identifying these advanced threats. This strategic shift in defense was necessary to counter the evolving tactics of actors who target the very tools meant to secure the network.
