New Malware Targets Fortinet Firewalls Through a FortiOS Vulnerability
Cybersecurity researchers have uncovered a previously unreported malware strain called PEERSTITCH, deployed by attackers exploiting a vulnerability in Fortinet’s FortiOS operating system. The malware is designed to bypass certain security checks on tagged VPN sessions while operating largely in memory, making it harder for conventional security tools to detect.
According to Palo Alto Networks Unit 42, the attackers exploited CVE-2025-61624, a path traversal vulnerability affecting FortiOS and several related Fortinet products. Fortinet released a patch for the flaw in April 2026.
The discovery highlights the risks posed by compromised network security appliances, particularly when attackers gain access to systems that manage VPN connections and protect enterprise networks.
How PEERSTITCH Works
PEERSTITCH is an ARM64 malware implant designed to modify the behaviour of legitimate FortiOS processes rather than operate as a conventional standalone application.
Researchers found that it targets two key system processes:
miglogd: Handles system and traffic logging functions.
iked: Manages Internet Key Exchange operations used by IPsec VPN connections.
By injecting code into these processes, the malware can inspect traffic already being handled by the firewall and manipulate selected VPN-session processing.
The researchers reported that PEERSTITCH looks for specific markers associated with tagged sessions. When a matching session is identified, its injected code can alter the normal execution path and bypass certain FortiOS security validations.
This targeted approach allows the attackers to interfere with selected VPN sessions without needing to open a separate listening port or establish a conventional outbound connection.
Why the Malware Is Difficult to Detect
PEERSTITCH uses several techniques designed to reduce its visibility.
Memory-resident operation: The implant operates by modifying running processes, leaving no persistent malware executable on disk according to the researchers.
Abuse of legitimate processes: Its activity takes place within existing FortiOS services, potentially making it harder to distinguish from normal system behaviour.
No dedicated listening port: The malware does not open its own listening port, reducing the number of obvious network indicators.
Limited external communication: Researchers reported that PEERSTITCH does not initiate its own outbound network connections. Instead, it works through traffic handled by legitimate processes on the compromised device.
These techniques demonstrate why organisations cannot rely solely on file-based antivirus detection or conventional network monitoring to identify sophisticated threats targeting network appliances.
The Vulnerability Behind the Attack
The campaign uses CVE-2025-61624, a path traversal flaw in the command-line interface of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager.
The vulnerability can allow an appropriately privileged attacker to write or delete files outside their intended locations through crafted command arguments. In the observed attack, the flaw was used to execute code with elevated privileges and deploy the PEERSTITCH loader.
The vulnerability carries a CVSS score of 5.4, but its use in a real intrusion demonstrates why organisations should consider exploitation activity and their own exposure, not just a numerical severity rating.
Fortinet patched the vulnerability in April 2026. Organisations should verify that their devices are running the appropriate fixed versions and review the vendor's security advisory for product-specific guidance.
What Security Teams Should Do
Organisations using Fortinet network security products should review their exposure and take practical defensive steps.
Apply security updates: Confirm that affected products have been updated to versions that address CVE-2025-61624.
Restrict administrative access: Limit access to management interfaces and command-line administration to trusted networks and authorised personnel.
Review VPN activity: Investigate unusual VPN sessions, unexpected authentication behaviour and suspicious configuration changes.
Examine system logs: Look for abnormal administrative commands, unexpected script execution and changes to firewall or VPN behaviour.
Investigate suspected compromise: If indicators of compromise are present, follow incident-response procedures and consult Fortinet or a qualified incident-response team. Patching alone may not remove an implant or reverse stolen credentials.
Because this malware can operate in memory, organisations should not assume a device is clean simply because no suspicious executable files are found.
Why This Matters for Enterprise Cybersecurity
Firewalls and VPN gateways sit at critical points in enterprise infrastructure. If attackers compromise these systems, they may gain opportunities to manipulate trusted connections, evade monitoring or access networks protected by the affected appliances.
PEERSTITCH illustrates how attackers can combine vulnerability exploitation, process injection and targeted manipulation of VPN traffic to evade conventional security controls.
For security teams, the incident reinforces the importance of timely patching, restricted administrative access, continuous monitoring and incident response that accounts for threats operating inside legitimate system processes.
