SECURITY researchers say attackers leveraged Fortinet FortiOS vulnerability CVE-2025-61624 to deploy a memory-resident ARM64 malware named PEERSTITCH. The flaw is a path traversal bug in the FortiOS command line interpreter that could let a privileged attacker write or delete arbitrary files via crafted arguments. Fortinet patched it in April 2026.
Unit 42 notes that PEERSTITCH operates without on-disk binaries, does not open listening ports and makes no outbound connections; instead it uses traffic generated by legitimate processes on the host to communicate, helping it evade standard endpoint and network detection.
The campaign is linked to a prolonged intrusion activity tracked as CL-STA-0954 (aka UNC5820) that began with FortiManager vulnerability exploitation (FortiJump, CVE-2024-47575). In the observed intrusion, attackers exfiltrated a run-time archive containing running configurations, cryptographic material and database files for more than 500 FortiGate firewalls, including device serial numbers, management relationships, and SSL/VPN credentials.
PEERSTITCH is 64-bit Linux ARM64, and downloads five components from 23.240.77[.]233:8085, with a memory-patching chain that targets /bin/miglogd and /bin/iked via ptrace hooks to implement a covert inter-process communication bridge and bypass FortiOS security checks during VPN sessions. Evidence also suggests a separate C2 path using Apache mod_md to spawn an SSH reverse shell. Investigators caution that exploit of CVE-2024-26009 and CVE-2024-26008 is possible, though requires FortiCloud SSO enrollment.