🔴 PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH.

The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a privileged attacker to achieve arbitrary write or delete files via specifically crafted arguments to existing commands. It was patched by Fortinet in April 2026.

"PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections," Palo Alto Networks Unit 42 researchers Daniel Gott and Shawn Westfall said. "Instead, it communicates through traffic generated by legitimate processes on the infected host, which makes the malware resistant to conventional endpoint and network detection."