https://reddit.com/r/Malware/comments/1x8byog/unit_42_uncovers_peerstitch_a_stealthy_fortigate/: Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
Published Oct 17, 2026
·Updated
Affected Software
2 affected components
Fortinet FortiManager
Fortinet FortiGate
Frequently Asked Questions
1
Was every FortiGate managed by the compromised FortiManager confirmed to be infected?
No. The attackers obtained configuration files and sensitive information associated with more than 500 FortiGate firewalls, but the investigation did not establish that all of those managed firewalls were compromised.
2
What access did the attackers gain through the FortiManager compromise?
After exploiting CVE-2024-47575 against the FortiManager appliance, the attackers obtained configuration files and sensitive information associated with the managed FortiGate firewalls.
3
Why might conventional antivirus scans fail to identify this implant?
PEERSTITCH operates in the memory of legitimate firewall processes instead of maintaining a conventional malware file on disk. This can leave fewer file-based indicators and allow the activity to blend into normal network operations.
4
What firewall functionality could the implant affect?
The implant could manipulate VPN security checks while operating within legitimate firewall processes.