FortiOS Flaw Exploited to Deliver New PEERSTITCH Malware
Attackers are leveraging a path traversal vulnerability in Fortinet products to deploy a stealthy, memory-resident ARM64 malware. Organizations using FortiOS should prioritize patching and monitoring for suspicious activity.
TL;DR
- A new malware called PEERSTITCH targets Fortinet devices via CVE-2025-61624.
- The flaw is a path traversal issue affecting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager.
- PEERSTITCH is memory-resident and designed to evade detection.
- It specifically bypasses security checks on tagged VPN sessions.
- Organizations are urged to apply patches and review network logs immediately.
Cybersecurity researchers have uncovered a sophisticated attack campaign leveraging a path traversal vulnerability in Fortinet’s FortiOS to deliver a previously unknown piece of malware dubbed PEERSTITCH. This ARM64-based, memory-resident malware is engineered to remain hidden while conducting malicious activities within compromised networks.
The vulnerability, tracked as CVE-2025-61624, affects multiple Fortinet products including FortiPAM, FortiProxy, and FortiSwitchManager. With a medium CVSS score of 5.4, it allows attackers to bypass authentication mechanisms under specific conditions—particularly those involving tagged VPN sessions—making it a potent entry point for targeted intrusions.
Understanding the Vulnerability
- CVE-2025-61624 is a path traversal flaw in the command line interpreter of several Fortinet products.
- It enables unauthorized access by allowing traversal outside intended directory structures.
- Exploitation can lead to remote code execution without proper authentication in certain configurations.
- Tagged VPN session handling contains a logic gap that attackers abuse to maintain stealth.
PEERSTITCH: The Hidden Threat
- PEERSTITCH is a newly discovered, memory-resident malware built for ARM64 architecture.
- Its fileless nature makes traditional signature-based detection ineffective.
- Once deployed, it establishes persistence and collects sensitive network data.
- The malware communicates back to attacker-controlled infrastructure over encrypted channels.
- Indicators of compromise include anomalous CLI usage and unexpected outbound traffic from Fortinet appliances.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.