PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
Overview
A sophisticated threat actor is exploiting a vulnerability in Fortinet's FortiOS, which affects several of its products including FortiPAM, FortiProxy, and FortiSwitchManager. The flaw, identified as CVE-2025-61624, allows attackers to bypass security checks on tagged VPN sessions. This exploitation leads to the deployment of a new type of malware called PEERSTITCH, which operates in memory on ARM64 architecture. The CVSS score for this vulnerability is 5.4, indicating a moderate level of risk. Companies using these Fortinet products should be vigilant and assess their systems for potential attacks, as the exploitation is currently active in the wild.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: Fortinet FortiOS, FortiPAM, FortiProxy, FortiSwitchManager
- Action Required: Organizations should apply security patches provided by Fortinet for the affected products.
- Timeline: Newly disclosed
Original Article Summary
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a
Impact
Fortinet FortiOS, FortiPAM, FortiProxy, FortiSwitchManager
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Newly disclosed
Remediation
Organizations should apply security patches provided by Fortinet for the affected products. Regular updates to FortiOS and related systems are recommended to mitigate the risk of exploitation. Additionally, network configurations should be reviewed to ensure that proper security checks are in place for VPN sessions.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to CVE, Fortinet, Vulnerability, and 1 more.