#8
The Hacker News
general
October 16, 2026 at 04:59 UTC
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
By [email protected] (The Hacker News)
AI Summary
A suspected advanced threat actor exploited CVE-2025-61624 (CVSS 5.4), a path traversal flaw in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, to deploy PEERSTITCH — a previously undocumented memory-resident ARM64 backdoor that bypasses inspection by operating in memory only. The malware is notable for its ability to bypass checks on tagged VPN sessions, providing persistent covert access on Fortinet edge devices. Organizations running affected Fortinet products should apply patches and inspect for in-memory indicators of compromise.
Relevance score: 76.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →