A sophisticated threat actor exploited a path traversal flaw in Fortinet FortiOS (CVE-2025-61624) to deploy a novel memory-resident malware called PEERSTITCH, which leaves no files on disk, opens no network ports, and instead communicates covertly by hooking into two legitimate FortiOS daemons to create a hidden inter-process communication channel. The attack, tracked as CL-STA-0954, began with the exploitation of a separate critical FortiManager vulnerability (CVE-2024-47575) to exfiltrate sensitive data — including configurations, credentials, and private keys — from over 500 managed FortiGate firewalls, which was then used to establish long-term covert access. Unit 42 researchers noted the attackers displayed deep knowledge of Fortinet's internal architecture and took extensive steps to remove forensic evidence, highlighting an escalating threat from adversaries targeting centralised network management platforms.
