CERT24PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN SessionsLoading data…
CERT24Threat Observatory
Period

PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

Palo Alto Networks Unit 42 observed the exploitation of a Fortinet FortiOS flaw to deploy PEERSTITCH, a previously unreported memory-resident ARM64 malware. The activity involved CVE-2025-61624, which Fortinet patched in April 2026. The malware leaves no persistent binary on disk, opens no listening ports, and initiates no outbound network connections, instead using legitimate processes on the infected host for communication.

← Back to intelligence

PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

Palo Alto Networks Unit 42 observed the exploitation of a Fortinet FortiOS flaw to deploy PEERSTITCH, a previously unreported memory-resident ARM64 malware. The activity involved CVE-2025-61624, which Fortinet patched in April 2026. The malware leaves no persistent binary on disk, opens no listening ports, and initiates no outbound network connections, instead using legitimate processes on the infected host for communication.