PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

A suspected advanced threat actor exploited a Fortinet FortiOS flaw, CVE-2025-61624 (CVSS 5.4), to deliver PEERSTITCH, a previously unreported memory-resident ARM64 malware. The path traversal vulnerability in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager allows attackers to bypass checks on tagged VPN sessions, enabling the malware deployment.