[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKPJ7C7imH-mpKiiRD6qLc3hU8SKae9ivXwuBZ61_XNM":3},{"article":4,"iocs":53,"watch_terms":68,"solutions":69,"lesson":167},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"08d92460-73ab-4a63-a923-06fb30dc2e6e","PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions","peerstitch-malware-deployed-via-fortios-flaw-bypasses-checks-on-tagged-vpn-sessi-a2dfa0","A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a","A suspected advanced threat actor is using a path traversal vulnerability (CVE-2025-61624) in Fortinet FortiOS to deploy a memory-resident ARM64 malware called PEERSTITCH. This malware avoids traditional detection by communicating through legitimate processes and initiating no outbound connections. The attack is part of a larger campaign (CL-STA-0954) that began with exploiting a FortiManager flaw (CVE-2024-47575) to steal sensitive configuration and credential data.","PEERSTITCH malware exploits FortiOS flaw to bypass VPN session checks.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fattackers-exploit-fortios-flaw-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiMvdc6m999SfUEEWC89wHnBiUX9WAMCSdWtbFP_lrH4DuREHfOJL7G29LkM4uAvittg3XsHxnq6dq_VEX1zB_jCGi5RJDbQZlrq37gHSCXpRrn11FEN-hezQn0Dt4Xcw4DcanklKW_8iLEnQN6JpzkQ7JHBOS1_dMzDAs2h_jJcWDqOGjbkMoeabOCkSFK\u002Fs1600\u002Ff.jpg","2026-10-16T04:59:36+00:00","2026-10-16T08:00:11.663501+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"FortiOS","product",{"name":21,"type":19},"FortiPAM",{"name":23,"type":19},"FortiProxy",{"name":25,"type":19},"FortiSwitchManager",{"name":27,"type":19},"FortiManager",{"name":29,"type":19},"FortiGate","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61,65],{"type":55,"value":56,"context":57},"cve","CVE-2025-61624","Path traversal flaw in FortiOS command line interpreter exploited by PEERSTITCH.",{"type":55,"value":59,"context":60},"CVE-2024-47575","FortiJump flaw in FortiManager exploited for initial access.",{"type":62,"value":63,"context":64},"ip","23.240.77.233","IP address hosting components for PEERSTITCH malware.",{"type":34,"value":66,"context":67},"PEERSTITCH","Previously unreported memory-resident ARM64 malware.",[18,21,23],{"controls":70,"vendors":157},[71,100,128],{"slug":72,"name":73,"problem":74,"products":75},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":101,"name":102,"problem":103,"products":104},"patch-management","Automated patch management","Known holes get closed in days, not months.",[105,112,120],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":101,"product_name":109,"url":110,"description":111},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":129,"name":130,"problem":131,"products":132},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[133,141,149],{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[158,164],{"slug":159,"name":160,"logo_path":161,"roles":162},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png",[163],"affected",{"slug":77,"name":78,"logo_path":79,"roles":165},[166],"reported_by",{"slug":168,"title":169,"body":170,"framework_refs":171,"framework_notes":186},"peerstitch-malware-exploits-unpatched-fortios-to-evade-detection-via-legitimate-processes","PEERSTITCH Malware Exploits Unpatched FortiOS to Evade Detection via Legitimate Processes","A sophisticated threat actor chained two Fortinet vulnerabilities — CVE-2024-47575 (FortiManager) and CVE-2025-61624 (FortiOS path traversal) — to deploy a stealthy, memory-resident malware that communicates exclusively through legitimate system processes and initiates no outbound connections, making traditional detection nearly impossible. The root cause is a failure to promptly patch critical network infrastructure, compounded by insufficient behavioral monitoring capable of detecting anomalous process communication patterns. This matters because network security appliances like VPN gateways sit at the perimeter and, when compromised, grant attackers privileged access to credentials, configurations, and internal network segments. The campaign demonstrates that unpatched edge devices are high-value targets for advanced persistent threat actors who increasingly rely on living-off-the-land techniques to remain undetected for extended periods.",[172,173,174,175,176,177,178,179,180,181,182,183,184,185],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST SI-2: Flaw Remediation","NIST SI-4: System Monitoring","NIST SC-7: Boundary Protection","NIST AC-4: Information Flow Enforcement","NIST IR-4: Incident Handling","ITIL Change Management: Emergency Change Procedures","Fortinet PSIRT Advisory FG-IR-25-254 (CVE-2025-61624)","Fortinet PSIRT Advisory FG-IR-24-423 (CVE-2024-47575)","MITRE ATT&CK T1055: Process Injection","MITRE ATT&CK T1190: Exploit Public-Facing Application",{}]