PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
Summary: A suspected advanced threat actor exploited CVE-2025-61624, a path traversal flaw in the FortiOS command line interpreter (CVSS 5.4, patched by Fortinet in April 2026), to deploy PEERSTITCH, a 64-bit Linux ARM64 malware written in C that leaves no binary on disk, opens no listening ports and makes no outbound connections. Unit 42 tied the activity to CL-STA-0954 (UNC5820), which gained initial access via the FortiJump FortiManager flaw (CVE-2024-47575) and exfiltrated an archive covering more than 500 managed FortiGate firewalls, then used the stolen data to open unauthorized SSL/VPN sessions and inject hooks into the /bin/miglogd and /bin/iked daemons so tagged VPN sessions bypass default FortiOS security validations.
What's compelling: The implant persists with no file on disk and no network signature, so endpoint and network detection have nothing to match on - and CISA's October 16, 2026 KEV addition of CVE-2025-61624 gave federal agencies until October 19, 2026 to patch.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2024-47575CVE-2025-61624
- Related
- CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerability Known Exploited Vulnerabilities · Oct 16, 2026Unit 42 Uncovers PEERSTITCH, a Stealthy Forti Gate Implant Cyber Risks · Oct 14, 2026CVE-2024-47575: Fortinet Forti Manager Missing Authentication Vulnerability Known Exploited Vulnerabilities · Oct 23, 2024