A new malware called PEERSTITCH is exploiting a FortiOS flaw to bypass VPN checks. Learn how it works and what you can do to protect your network.
Security researchers have spotted a sophisticated threat actor exploiting a flaw in Fortinet's FortiOS to deliver a previously unknown malware called PEERSTITCH. This memory-resident ARM64 malware is designed to evade detection and maintain persistence on compromised systems.
The vulnerability, tracked as CVE-2025-61624, has a CVSS score of 5.4. It's a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. If exploited, it could allow an attacker to execute arbitrary commands on the underlying system.
### How the Attack Works
The attackers are targeting VPN sessions that have been tagged in some way—perhaps by user role or device type. By exploiting the path traversal flaw, they can bypass security checks that are normally applied to these sessions. Once inside, they deploy PEERSTITCH, which resides in memory and is thus harder to detect than traditional file-based malware.
PEERSTITCH is specifically compiled for ARM64 architecture, which suggests the attackers are targeting newer FortiGate appliances that use ARM processors. This isn't your run-of-the-mill malware; it's a custom-built tool that indicates a high level of sophistication.
### Why This Matters
If you're running Fortinet products, this is a wake-up call. The flaw isn't extremely critical (CVSS 5.4), but the fact that it's being actively exploited in the wild to deliver advanced malware means you can't afford to ignore it.
- **Patch now**: Fortinet has released updates for all affected products. Apply them as soon as possible.
- **Monitor VPN sessions**: Keep an eye out for unusual activity on tagged VPN sessions, especially those with elevated privileges.
- **Check for indicators of compromise**: Look for signs of PEERSTITCH, such as unusual memory usage or network traffic from your FortiGate devices.
> "The attackers are clearly well-resourced and are targeting specific environments," said a researcher familiar with the investigation. "This isn't opportunistic; it's targeted."
### What You Can Do
First, make sure your FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager installations are up to date. Don't wait—exploitation is happening now.
Second, review your VPN configurations. Are you tagging sessions? If so, ensure that those tags are properly secured and that any checks applied to them are robust. The attackers are specifically looking for weaknesses in how tagged sessions are handled.
Finally, consider implementing additional monitoring for memory-resident threats. Traditional antivirus might miss PEERSTITCH, so you'll need tools that can detect anomalous behavior in memory.
This incident is a reminder that even medium-severity vulnerabilities can be dangerous when combined with advanced malware. Stay vigilant, keep your systems patched, and monitor for unusual activity. The bad guys are always finding new ways to get in—don't make it easy for them.
For more details on the vulnerability and mitigation steps, check out Fortinet's official advisory. (Remember to verify the source and apply patches from trusted channels.)
