PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a

The report describes exploitation of a FortiOS path-traversal flaw to deploy PEERSTITCH, a memory-resident ARM64 implant that modifies VPN-related processes and can bypass default security validations.[1][2] No direct AI system, model, or AI-specific attack is identified. RealGround analysis: the incident is relevant to AI environments only where Fortinet infrastructure supports AI agents or services, creating a third-party infrastructure and software supply-chain risk; organizations should inventory dependencies, validate patching, and assess monitoring for compromised network controls.