// AI threat desk · 17 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesHighCVECVSS 5.4

FortiOS flaw CVE-2025-61624 exploited to deploy PEERSTITCH

The flaw affects FortiOS, FortiPAM, FortiProxy and FortiSwitchManager and has a CVSS score of 5.4, The Hacker News reported.

· 2 min read
AI-generated image of security analysts reviewing blurred vulnerability dashboards and network diagrams in a monitoring centre.
AI-generated image, not a photo of the event.
Key takeaways
  • The Hacker News reported that the flaw affects FortiOS, FortiPAM, FortiProxy and FortiSwitchManager and has a CVSS score of 5.4.
  • The attackers used legitimate credentials to establish unauthorized FortiGate SSL/VPN sessions from external staging infrastructure.

Using legitimate credentials, the attackers established unauthorized FortiGate SSL/VPN sessions to perimeter firewalls from known external staging infrastructure.

The Hacker News reported that CVE-2025-61624 affects FortiOS, FortiPAM, FortiProxy and FortiSwitchManager and has a CVSS score of 5.4.

On this page

PEERSTITCH patched FortiOS processes in memory

PEERSTITCH is a 64-bit Linux ARM64 executable written in C and statically linked against glibc. Its injector targeted the FortiOS daemons /bin/miglogd and /bin/iked.

The malware created a covert, memory-resident communication bridge between those daemons instead of using network sockets or disk files. When a matching tag existed, a hook took an alternate return branch that bypassed default FortiOS security validations.

Unit 42 said PEERSTITCH left no persistent binary on disk, opened no listening ports and initiated no outbound network connections. It communicated through traffic generated by legitimate processes on the infected host, which made it resistant to conventional endpoint and network detection.

Attackers recovered firewall credentials from FortiManager data

The attackers initially compromised a centralized FortiManager appliance by exploiting CVE-2024-47575. They exfiltrated running configurations, cryptographic material and database files containing information about more than 500 managed FortiGate firewalls.

Unit 42 said it confirmed the credentials were recoverable by successfully brute-forcing administrative and SSL/VPN passwords from the exfiltrated configuration files.

Alongside PEERSTITCH, the attackers established a command-and-control channel by weaponizing the native Apache mod_md module on FortiGate firewalls.

Following FGFM interactions from external infrastructure, an administrative account named FortiGateCloud downloaded complete running configurations from multiple managed firewalls. Unit 42 assessed with medium confidence that the attackers issued those commands by impersonating the management platform over FGFM.

Unit 42 identified memory and syscall indicators

Unit 42 recommended inspecting memory maps of /bin/miglogd and /bin/iked for anonymous 16,384-byte regions with rwxp permissions.

Unit 42 said Palo Alto Networks shared these findings with fellow Cyber Threat Alliance members.

Unit 42 said defenders must also treat the credentials and certificates those interfaces hold as compromised the moment the platform is.

What to do now

  1. Treat the credentials and certificates held by a management platform as compromised the moment the platform is compromised.

FAQ

What happened in the FortiGate CVE-2025-61624 intrusion?

Unit 42 said attackers exploited CVE-2025-61624 to escalate from FortiOS administrative access to root on the underlying firewall operating system and deploy PEERSTITCH.

Which products are affected by CVE-2025-61624?

The Hacker News reported that the flaw affects FortiOS, FortiPAM, FortiProxy and FortiSwitchManager and has a CVSS score of 5.4.

What is PEERSTITCH?

Unit 42 described PEERSTITCH as a memory-resident ARM64 malware that creates a covert communication bridge between the FortiOS daemons /bin/miglogd and /bin/iked.

How did the attackers reach the FortiGate firewalls?

They compromised a centralized FortiManager appliance and exfiltrated configurations and cryptographic material. Unit 42 confirmed administrative and SSL/VPN credentials were recoverable from the configuration files, and the attackers used legitimate credentials to establish unauthorized SSL/VPN sessions.

What detection steps did Unit 42 recommend?

Unit 42 recommended inspecting memory maps of /bin/miglogd and /bin/iked for anonymous 16,384-byte regions with rwxp permissions and auditing kernel syscall telemetry for open() and write() operations targeting /proc/ /mem between the two processes.

Sources

  1. Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant, Unit 42Primary
  2. PSIRT | FortiGuard Labs, FortinetPrimary
  3. PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions, The Hacker News
How we checked this story
ClaimSourceStatus
Unit 42 investigated a multi-stage network intrusion against a telecommunications organization that occurred in September 2024.Unit 42Confirmed
The attackers initially compromised a centralized FortiManager appliance by exploiting CVE-2024-47575.Unit 42Confirmed
The attackers exfiltrated configurations, cryptographic material and databases containing information about more than 500 managed FortiGate firewalls.Unit 42Confirmed
The attackers used legitimate credentials to establish unauthorized FortiGate SSL/VPN sessions from external staging infrastructure.Unit 42Confirmed
The attackers exploited CVE-2025-61624 to escalate from FortiOS administrative access to root on the underlying firewall operating system.Unit 42Confirmed
The exploit facilitated deployment of PEERSTITCH, a novel memory-resident ARM64 malware.Unit 42Confirmed
The Hacker News reported that CVE-2025-61624 has a CVSS score of 5.4 and affects FortiOS, FortiPAM, FortiProxy and FortiSwitchManager.The Hacker NewsAttributed
Fortinet’s advisory says the path-traversal flaw may allow a privileged attacker to arbitrarily write or delete files through crafted arguments to existing commands.FortinetConfirmed
PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections.Unit 42Confirmed
PEERSTITCH communicates through traffic generated by legitimate processes, making it resistant to conventional endpoint and network detection.Unit 42Confirmed
PEERSTITCH is a 64-bit Linux ARM64 executable written in C and statically linked against glibc.Unit 42Confirmed
The injector targets the FortiOS daemons /bin/miglogd and /bin/iked.Unit 42Confirmed
The attackers downloaded five PEERSTITCH files from 23.240.77[.]233:8085 into /data2/template/.Unit 42Confirmed
PEERSTITCH creates a covert memory-resident communication bridge between /bin/miglogd and /bin/iked instead of using network sockets or disk files.Unit 42Confirmed
When a matching tag exists, the /bin/iked hook takes an alternate return branch that bypasses default FortiOS security validations.Unit 42Confirmed
Unit 42 assessed with medium confidence that the attackers issued those commands by impersonating the management platform over FGFM.Unit 42Confirmed
Unit 42 recommends inspecting memory maps of /bin/miglogd and /bin/iked for anonymous 16,384-byte regions with rwxp permissions.Unit 42Confirmed
unit42.paloaltonetworks.com published its report on Oct 14, 2026.unit42.paloaltonetworks.comConfirmed

Could not verify

  • Whether CVE-2025-61624 was exploited outside this intrusion is not established
  • How many FortiGate firewalls were infected is not established
  • Whether the suspected advanced threat actor’s identity is established
  • Whether CVE-2024-26008 or CVE-2024-26009 were used is not established
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok