PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

A suspected advanced threat actor has been exploiting CVE-2025-61624, a path traversal vulnerability (CVSS 5.4) in Fortinet FortiOS's command line interpreter, to deploy a previously unreported memory-resident ARM64 malware dubbed PEERSTITCH. The vulnerability also affects FortiPAM, FortiProxy, and FortiSwitchManager. The malware is notable for its ability to bypass security checks on tagged VPN sessions, making detection and remediation more difficult. PEERSTITCH resides in memory, leaving minimal forensic artifacts on disk. The attack chain highlights the continued targeting of network edge devices by sophisticated threat actors. Organizations using affected Fortinet products are urged to apply patches and monitor for indicators of compromise.