New ARM64 Malware PEERSTITCH Exploits FortiOS Vulnerability to Slip Past VPN Controls

An unidentified, likely sophisticated threat group has begun leveraging a recently disclosed Fortinet FortiOS flaw to install a novel ARM64 memory‑resident malware dubbed PEERSTITCH. The campaign, first highlighted by security outlet The Hacker News, exploits CVE‑2025‑61624, a path‑traversal weakness that allows attackers to bypass integrity checks on tagged VPN sessions.

The CVE, assigned a CVSS score of 5.4, permits malicious actors to traverse directories on the FortiOS file system and place executable code where it can be loaded by the operating system. In this case, the payload is a previously unknown ARM64 binary that remains resident in memory, making detection by traditional file‑based antivirus solutions difficult.

PEERSTITCH appears to be tailored for devices running on ARM64 architecture, a growing segment that includes many modern firewalls, edge routers, and IoT gateways. By embedding itself in memory, the malware can maintain persistence across reboots and potentially exfiltrate data or provide a foothold for further lateral movement within compromised networks.

Fortinet, a major supplier of network security appliances, has issued advisories urging administrators to apply the latest firmware updates that address the path‑traversal issue. However, the moderate CVSS rating suggests that exploitation may require specific conditions—such as a valid VPN session tag—limiting the attack surface to organizations that rely heavily on FortiOS‑based VPN services.

Security researchers note that the use of a previously unseen ARM64 payload signals an evolution in threat actors’ toolkits, reflecting a shift toward targeting the expanding ecosystem of low‑power, high‑performance processors. This trend complicates defensive strategies, as many endpoint protection products are still optimized for x86 binaries.

While the exact motivations behind the PEERSTITCH deployment remain unclear, the capability to evade VPN session checks could enable the actors to infiltrate corporate environments that consider VPNs a secure perimeter. Analysts caution that once inside, the malware could be used to harvest credentials, monitor traffic, or deploy additional payloads.

Organizations are advised to review their VPN configurations, enforce strict access controls, and monitor for anomalous memory activity on ARM‑based devices. Continuous threat‑intelligence feeds and rapid patch management are critical to mitigating the risk posed by this emerging threat.

The discovery underscores the importance of timely vulnerability remediation and highlights how even moderate‑severity flaws can be weaponized when paired with custom, architecture‑specific malware. As the cybersecurity community continues to track PEERSTITCH, further details about its command‑and‑control infrastructure and potential payloads are expected to emerge.