1. Executive summary
A suspected advanced threat actor has been observed exploiting CVE-2025-61624, a path traversal flaw in the FortiOS command line interpreter, to deliver a previously unreported memory-resident ARM64 implant tracked as PEERSTITCH. The verified reference data records CVE-2025-61624 at CVSS 6.0 MEDIUM, CWE-22, EPSS 1%, and confirms it is not listed in CISA KEV; the primary source quotes CVSS 5.4, a discrepancy noted in §3. The affected products are FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, which places any EMEA financial services estate running Fortinet edge or management appliances in scope. The bottom-line risk is a memory-resident implant on a perimeter device that survives on-box inspection and is positioned to observe or manipulate VPN traffic, including sessions the operator has tagged as trusted. Attribution is unconfirmed: the primary source names no actor, and the related Unit 42 reporting ties PEERSTITCH to a separate CVE-2024-47575 campaign, so the two cannot be merged without further evidence.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 18 | A memory-resident implant on a Fortinet perimeter appliance is an ICT-related incident that must be classified against the criteria in Art. 18 before any reporting decision. | The classification record must capture the affected function (VPN/remote access), duration of implant residency, and whether client data or payment traffic traversed the tagged sessions. |
| DORA Art. 28 | The exploited component is a third-party ICT product (Fortinet FortiOS, FortiPAM, FortiProxy, FortiSwitchManager) and the fix depends on the vendor. | Contractual and exit documentation for the Fortinet estate must be checked against Art. 28 expectations, and the vendor advisory tracked as the authoritative remediation source. |
| NIS2 Art. 21(2)(d) | The initial access vector is a vulnerability in a supplied network product, which is a supply chain security exposure for entities in NIS2 scope. | Supply chain security measures must cover how Fortinet advisories are ingested, triaged, and applied, not just the fact that a patch exists. |
3. Technical analysis & attack chain
Confirmed steps from the source material:
- The actor exploits CVE-2025-61624, a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager.
- Exploitation delivers PEERSTITCH, a memory-resident ARM64 malware implant, to the target appliance.
- The implant operates on tagged VPN sessions, bypassing the checks that would normally apply to those sessions.
That is the full extent of the confirmed chain in the primary source. The source does not describe the request that triggers the traversal, the file path traversed, the delivery mechanism for the ARM64 payload, persistence, privilege escalation, command-and-control, lateral movement, or exfiltration. Those gaps are stated rather than filled.
Vulnerability mechanism. CVE-2025-61624 is a path traversal (CWE-22 per the verified reference data) in the FortiOS command line interpreter. The verified reference data records CVSS 6.0 MEDIUM; the primary source quotes CVSS 5.4. Both describe the same flaw and the verified value is used throughout this advisory. EPSS is 1% and the CVE is not in CISA KEV, so mass opportunistic exploitation is not indicated by the scoring data; the observed activity is targeted.
Payload. PEERSTITCH is ARM64 and memory-resident. Memory residency means the implant does not need to write a file to disk to run, which removes the artefact most on-box antivirus and file-integrity tooling relies on. ARM64 indicates the target hardware is an ARM-based Fortinet appliance rather than an x86 virtual instance. The primary source does not name the specific appliance models, the FortiOS build numbers affected, or the firmware version that carries the fix.
Tagged VPN session bypass. The source states the malware bypasses checks on tagged VPN sessions but does not define what "tagged" means in this context, which check is bypassed, or whether the tag is set by the appliance, by the management plane, or by the operator. Treat this as a single-sourced behavioural claim until a second source or vendor confirmation is available.
Attribution caveat. The primary source describes a "suspected advanced threat actor" and names no group. The related Unit 42 reporting covers PEERSTITCH in the context of CVE-2024-47575 and a campaign against 500+ firewalls, which is a different CVE and a different intrusion. There is no MITRE ATT&CK profile for a named actor in the verified reference data, so attribution is unconfirmed and the two campaigns should not be treated as the same operation without corroboration. The Unit 42 material is single-sourced for the CVE-2024-47575 linkage.
4. Mitigation & containment
P1 (within 24 hours)
- Inventory every FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager instance in the estate and record model, firmware build, and whether it is ARM-based. The source does not give affected version ranges, so the vendor advisory is the only authoritative source for which builds are vulnerable and which build carries the fix.
- Isolate any appliance with evidence of unexpected process activity, unexplained outbound connections, or configuration changes on VPN session handling. Because PEERSTITCH is memory-resident, a clean on-disk scan is not evidence of absence; treat the appliance as suspect until it has been rebuilt from a known-good image.
- Rotate credentials and certificates used for VPN authentication and for management-plane access on any appliance in scope, and invalidate active VPN sessions. The source states the implant operates on tagged VPN sessions, so sessions established before containment cannot be assumed clean.
P2 (within 72 hours)
- Apply the vendor fix for CVE-2025-61624 to all affected Fortinet products once Fortinet publishes the version mapping. Until then, restrict management-plane access to a dedicated out-of-band network and remove any internet-facing administrative interface on FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager.
- Add detection for the behavioural indicators in §5 at the appliance and at the SIEM, and forward FortiOS event logs to a platform that retains them beyond the appliance's local buffer. A memory-resident implant can clear or avoid local logging.
- Review VPN session logs for the period before containment for sessions that authenticated successfully but did not match the expected device posture or tag state.
P3 (within 7 days)
- Fold Fortinet advisory ingestion into the supply chain security process referenced in §2, with a named owner and a defined maximum time from vendor publication to estate-wide assessment.
- Re-baseline the Fortinet estate configuration against a known-good reference and enable configuration-change alerting on the management plane.
5. Indicators of compromise
No atomic indicators (hashes, domains, IPs, file paths, registry keys) are present in the source material. The source describes behaviour only.
| type | value | confidence | source |
|---|---|---|---|
| n/a | n/a | n/a | n/a |
Behavioural indicators:
| behaviour | where to observe | confidence |
|---|---|---|
| Memory-resident ARM64 implant on a Fortinet appliance with no corresponding file on disk | Appliance process listing and memory, EDR telemetry if the appliance is instrumented | Medium, single-sourced |
| Bypass of checks on tagged VPN sessions | FortiOS VPN session logs, authentication logs, management-plane audit logs | Low, single-sourced and undefined in the source |
| Exploitation of the FortiOS command line interpreter via path traversal | FortiOS CLI audit logs, management-plane access logs | Medium, single-sourced |
No copyable indicator block is provided because no atomic indicators exist in the source material.
6. Detection
The sources contain no distinctive strings, command-line flags, mutex names, file names, registry keys, or hard-coded values attributable to PEERSTITCH. The only named artefacts are the malware family name, the CVE identifier, and the affected product names, none of which are artefacts of the threat itself. A YARA rule built from those would detect reporting about the threat, not the threat.
Insufficient indicators to author detection rules.
CVE assessment
1 referenced CVE
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2025-61624 | 6.0 Medium | — | 1% | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.… |
7. Sources
- The Hacker News, "PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions", https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html, 2026-10-16.
- Palo Alto Unit 42, "Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant", https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/, date not stated in the supplied extract.
8. Adverse Trace position
Adverse Trace assesses CVE-2025-61624 at CVSS 6.0 MEDIUM per the verified reference data, not in CISA KEV, EPSS 1%, and treats the exploitation as targeted rather than opportunistic. The severity of the underlying CVE is moderate; the operational risk to a financial services client is higher than the score suggests because the implant is memory-resident on a perimeter device and the source states it bypasses checks on tagged VPN sessions, which is the control path most clients rely on for remote access. Attribution is unconfirmed and we will not name an actor. The PEERSTITCH linkage to CVE-2024-47575 rests on a single vendor report and should not be merged with this campaign without corroboration. We will track the Fortinet advisory for the affected version ranges and the fixed build, and we will reissue this note if the vendor confirms the tagged-session bypass mechanism or publishes atomic indicators. Clients running Fortinet edge or management appliances should complete the P1 steps in §4 before the end of the next business day and treat any appliance with unexplained process or network activity as compromised until rebuilt.
Published via PulseTrace — Adverse Trace threat intelligence.