Quick Takeaways
- A sophisticated threat actor exploited a Fortinet FortiOS vulnerability (CVE-2025-61624) to deploy the stealthy ARM64 malware PEERSTITCH, which communicates through legitimate processes to evade detection.
- The attacker exfiltrated sensitive data from over 500 managed FortiGate firewalls, including configurations, cryptographic materials, and network topologies, to facilitate ongoing reconnaissance and backdoor access.
- PEERSTITCH creates covert, memory-based communication links between core services, using in-memory hooks and markers to bypass security validations and maintain persistence undetected.
- The intrusion underscores the increasing risks of weaponized edge device management ecosystems, highlighting advanced malware techniques that avoid disk artifacts and leverage intra-process communication for sustained stealth.
New Malware Exploit Targets FortiOS Flaws
Recently, a sophisticated threat actor exploited a security flaw in Fortinet’s FortiOS systems. This flaw, known as CVE-2025-61624, is a path traversal vulnerability that allows attackers to manipulate command line processes. Fortinet patched this weakness in April 2026, but the malware used in the attack had already been deployed. The malware, called PEERSTITCH, is unique because it does not leave traditional traces like files on disk or open network ports. Instead, it communicates covertly by blending in with legitimate processes, making detection difficult. This kind of attack shows how advanced malware is becoming, especially in how it avoids standard security measures.
The attack originated during a large network intrusion aimed at a telecommunications provider. The hackers successfully gained access and stole critical information, including configuration files, credentials, and network maps for over 500 firewalls. They also harvested cryptographic keys, which they used to understand the network better and maintain long-term access. Using this information, they set up unauthorized VPN sessions, deployed backdoors, and continued exploiting vulnerabilities. The malware itself is a Linux-based ARM64 executable that downloads additional malicious components. These components then work together to manipulate system processes and hide their activity inside the device’s memory, making it easier for attackers to stay undetected.
Expand Your Tech Knowledge
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Stay inspired by the vast knowledge available on Wikipedia.
DataProtection-V1
