A sophisticated threat actor was observed exploiting a security vulnerability in Fortinet FortiOS to deploy a novel memory-resident ARM64 malware known as PEERSTITCH. This advanced attack leverages a path traversal flaw, CVE-2025-61624, to achieve arbitrary file manipulation, enabling the deployment of this stealthy implant. The discovery was made by Palo Alto Networks Unit 42 researchers during an investigation into a prolonged network intrusion against a telecommunications managed service provider, with further coverage provided by The Hacker News.
The attack chain began with the exploitation of a critical Fortinet FortiManager flaw (CVE-2024-47575), allowing attackers to exfiltrate sensitive data including configurations and credentials for over 500 managed FortiGate firewalls. This information was used for reconnaissance and to establish long-term access. Subsequently, the CVE-2025-61624 vulnerability was exploited to deploy PEERSTITCH. This malware operates without leaving persistent traces on disk or opening listening ports, instead using legitimate processes for communication, making it difficult to detect. PEERSTITCH injects malicious code into core FortiOS daemons, miglogd and iked, creating a covert, memory-resident communication bridge. Attackers also established a separate command-and-control channel using Apache's mod_md module for an SSH-based reverse shell. The attackers demonstrated deep knowledge of Fortinet's architecture and internal workings, employing techniques to erase forensic artifacts. This incident highlights the increasing maturity of edge-device malware and the weaponization of centralized management systems to compromise downstream networks.
Source: The Hacker News
