PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

A sophisticated threat actor chained two Fortinet vulnerabilities — CVE-2024-47575 (FortiManager) and CVE-2025-61624 (FortiOS path traversal) — to deploy a stealthy, memory-resident malware that communicates exclusively through legitimate system processes and initiates no outbound connections, making traditional detection nearly impossible. The root cause is a failure to promptly patch critical network infrastructure, compounded by insufficient behavioral monitoring capable of detecting anomalous process communication patterns. This matters because network security appliances like VPN gateways sit at the perimeter and, when compromised, grant attackers privileged access to credentials, configurations, and internal network segments. The campaign demonstrates that unpatched edge devices are high-value targets for advanced persistent threat actors who increasingly rely on living-off-the-land techniques to remain undetected for extended periods.