A suspected advanced threat actor is exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware tracked as PEERSTITCH.
The vulnerability in question is CVE-2025-61624, a path traversal flaw in the command line interpreter affecting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. It carries a CVSS score of 5.4. According to the reporting, successful exploitation could allow an attacker to bypass checks on tagged VPN sessions.
Key points from the research so far:
The malware, PEERSTITCH, is described as memory-resident and compiled for ARM64 architectures, and had not been publicly documented before this campaign.
The flaw is a path traversal issue in the CLI interpreter shared across multiple Fortinet products, not just FortiOS.
The actor behind the activity is described as suspected advanced, though attribution has not been confirmed.
Defenders running any of the affected Fortinet products should treat this as a priority: review exposure of management interfaces, monitor for unusual CLI activity, and watch for suspicious processes or artifacts consistent with in-memory ARM64 payloads. Because the malware resides in memory, traditional file-based scanning may miss it entirely, so behavioral detection and logging of tagged VPN session activity are worth prioritizing.
Source: The Hacker News
Has anyone in the community observed unusual CLI or VPN session behavior on their Fortinet appliances, and how are you approaching detection for memory-only payloads like this?
