PEERSTITCH Propose Change

According to Palo Alto Networks Unit 42, PEERSTITCH is a memory-resident implant for FortiGate firewalls, built as a 64-bit Linux ARM64 executable written in C and statically linked against glibc, which was deployed after a FortiOS privilege escalation that grants root access. It acts as a one-shot injector that uses ptrace to attach to the FortiOS logging daemon and the IKE/IPsec VPN daemon, maps an executable memory region in each, writes hook code into it and patches daemon code to redirect execution and suppress tamper detection, before unlinking its own binary from disk. The implant opens no listening ports and initiates no outbound connections, instead inspecting traffic that already passes through the hooked daemons for marker strings and exchanging extracted session tags between the two processes by writing directly into each other's memory. When the VPN daemon later finds a matching tag, the hook takes an alternate code path that bypasses FortiOS security validation, which makes the implant resistant to conventional endpoint and network detection.

References

There is no Yara-Signature yet.