PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
Summary
A new memory-resident ARM64 malware called PEERSTITCH is being deployed by exploiting a path traversal vulnerability (CVE-2025-61624) in Fortinet's FortiOS. This vulnerability allows attackers to bypass security checks on tagged VPN sessions, granting them unauthorized access.
IFF Assessment
The exploitation of a critical vulnerability in network infrastructure and the deployment of new malware represent a significant threat to organizations.
Severity
Defender Context
This incident highlights the ongoing threat posed by sophisticated actors exploiting vulnerabilities in widely used network devices like Fortinet firewalls. Defenders must prioritize patching this CVE and actively monitor for indicators of compromise related to PEERSTITCH malware, especially on networks utilizing FortiOS and tagged VPN sessions.