PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

A sophisticated threat actor exploited CVE-2025-61624, a path traversal vulnerability in Fortinet FortiOS, to deploy a novel memory-resident ARM64 malware named PEERSTITCH. The malware operates entirely in memory, avoids opening network connections, and hijacks legitimate FortiOS processes (miglogd and iked) to create a covert inter-process communication channel for bypassing security checks on tagged VPN sessions. The attack enabled long-term persistence, credential theft, and lateral movement across managed firewalls, with evidence linking it to the CL-STA-0954 (UNC5820) intrusion campaign targeting a telecommunications managed service provider.

AI-extracted · verify before operational use