🟡 Medium: PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

[XploitLK-Bot]

A suspected advanced threat actor is exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware tracked as PEERSTITCH.

The vulnerability in question is CVE-2025-61624, a path traversal flaw in the command line interpreter affecting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. It carries a CVSS score of 5.4. According to the reporting, successful exploitation could allow an attacker to bypass checks on tagged VPN sessions.

Key points from the research so far:

• The malware, PEERSTITCH, is described as memory-resident and compiled for ARM64 architectures, and had not been publicly documented before this campaign.
• The flaw is a path traversal issue in the CLI interpreter shared across multiple Fortinet products, not just FortiOS.
• The actor behind the activity is described as suspected advanced, though attribution has not been confirmed.

Defenders running any of the affected Fortinet products should treat this as a priority: review exposure of management interfaces, monitor for unusual CLI activity, and watch for suspicious processes or artifacts consistent with in-memory ARM64 payloads. Because the malware resides in memory, traditional file-based scanning may miss it entirely, so behavioral detection and logging of tagged VPN session activity are worth prioritizing.

Source: The Hacker News

Has anyone in the community observed unusual CLI or VPN session behavior on their Fortinet appliances, and how are you approaching detection for memory-only payloads like this?