Fortinet CVE-2025-61624 exploited to deploy PEERSTITCH malware

En bref

• CVE-2025-61624 is a path traversal bug in FortiOS being exploited in the wild.
• The payload, PEERSTITCH, is ARM64 malware that operates from memory.
• Attackers are bypassing VPN session validation to maintain access.
• FortiPAM, FortiProxy, and FortiSwitchManager are also named in the advisory.
• The number of affected organizations remains undisclosed as of October 2026.

In October 2026, a suspected sophisticated adversary was observed exploiting a directory traversal vulnerability tracked as CVE-2025-61624 in Fortinet's FortiOS. The flaw enables attackers to circumvent VPN session validation and push a payload named PEERSTITCH, which is ARM64-compatible malware that resides in memory. The campaign also references FortiOS, along with FortiPAM, FortiProxy, and FortiSwitchManager, though the precise role of each product has not been detailed.

Organizations relying on Fortinet's FortiOS for remote access VPNs, particularly those running ARM64-based appliances or virtual instances, may be at risk. The number of victims has not been quantified, and the targeted sectors remain unclear. Government and education entities should remain vigilant given the potential for espionage or disruptive activity.

Memory-resident malware is challenging to detect because it leaves minimal artifacts on disk. Bypassing VPN session verification could allow an intruder to maintain persistent access without re-authentication. The involvement of a suspected advanced actor suggests a focused intrusion set rather than opportunistic scanning.

As of the report, Fortinet has not released a patch. Administrators should monitor for updates and watch for indicators such as unusual VPN session behavior or unexpected ARM64 processes. The situation is evolving, and further details on scale and attribution may emerge.

À faire maintenant

1. Apply any available Fortinet security updates for FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager immediately.
2. Review VPN logs for anomalous session creation, especially those that bypass expected authentication checks.
3. Hunt for memory-resident ARM64 processes and unusual outbound connections on Fortinet appliances.
4. Enable multi-factor authentication and enforce strict session timeouts for VPN access.
5. Isolate or reboot affected appliances if PEERSTITCH indicators are found, as memory-resident malware may not survive a restart.
6. Monitor Fortinet advisories and threat intelligence for CVE-2025-61624 updates.
7. Consider network segmentation to limit lateral movement from compromised VPN gateways.

Références CVE

• CVE-2025-61624

Source originale

The Hacker News