What Happened
A suspected advanced threat actor has been observed exploiting CVE-2025-61624 in Fortinet technology to deploy PEERSTITCH, a previously unreported memory-resident ARM64 malware.
The vulnerability has a CVSS score of 5.4 and is described as a path traversal flaw in the command-line interpreter. The affected product families named in the report are:
FortiOS
FortiPAM
FortiProxy
FortiSwitchManager
The reported campaign is especially significant because PEERSTITCH operates in memory and the attack can bypass checks involving tagged VPN sessions. This makes the issue more than a routine vulnerability-management task: defenders must address both firmware exposure and possible post-exploitation activity.
Why the CVSS Score Is Not the Whole Story
A medium CVSS score should not be treated as evidence of low operational risk. The source reports observed exploitation by a suspected advanced threat actor and malware deployment, providing real-world context that a numerical score alone cannot convey.
Prioritization should therefore account for:
Whether an affected product is deployed in the environment
Its current firmware release and exposure
Its role in VPN, privileged-access, proxy, switching, or management workflows
Evidence of unusual tagged VPN sessions or administrative activity
Whether the asset can still receive an appropriate fixed firmware release
The presence of memory-resident malware also means that installing new firmware should not automatically be considered proof that a device was never compromised.
Firmware Remediation Workflow
The report identifies the affected product families but the supplied source summary does not provide the exact fixed versions for every product and firmware branch. Teams should verify the applicable release directly against current Fortinet guidance rather than assuming that one version applies across the portfolio.
A controlled response should include:
Inventory affected products. Find every FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager instance, including standby and remotely deployed systems.
Record current firmware. Capture the exact product, model, firmware release, management address, location, and business owner.
Validate the required update. Match each asset and release branch to the vendor’s current remediation guidance.
Back up configurations. Preserve a known configuration state before making changes.
Install validated fixed firmware. Follow the approved upgrade path and confirm that the device returns to its expected operating state.
Compare pre- and post-change state. Review configuration differences rather than relying only on a successful reboot or version display.
Investigate possible compromise. Examine available VPN session, command-line, administrative, configuration-change, and security records, preserving relevant evidence.
Document completion. Retain proof of the affected asset, original release, remediation action, resulting release, date, and approver.
Patching closes the known firmware exposure; it does not by itself determine whether PEERSTITCH or another payload was previously active.
Evidence of PEERSTITCH Activity
The key evidence presented by the report is that attackers have already used CVE-2025-61624 to deliver PEERSTITCH. The malware is described as ARM64, memory-resident, and previously unreported.
Defenders should avoid inventing indicators or relying on unverified signatures. Instead, they should use the technical indicators published by the original researchers and vendor, while preserving locally available evidence related to:
Tagged VPN sessions
Administrative and command-line activity
Unexpected configuration changes
Firmware and reboot history
Security events around the suspected exploitation window
Because the malware is memory-resident, incident-response decisions should not depend solely on disk-based searches. Assets showing credible signs of compromise should be handled through the organization’s established containment, evidence-preservation, recovery, and credential-review procedures.
How ConnectMyAssets Helps
ConnectMyAssets provides an on-prem, vendor-agnostic workflow for turning this advisory into an asset-level remediation program:
Dynamic CMDB identifies affected Fortinet assets and records their model, firmware, ownership, location, and operational role.
Per-asset CVE Tracking associates CVE-2025-61624 with relevant devices, allowing teams to distinguish potentially exposed assets from remediated ones.
Backup & History captures configuration versions before and after firmware work, supports change comparison, and provides one-click rollback when appropriate.
Automation can coordinate validated firmware and verification tasks across selected assets without assuming that every product follows the same upgrade path.
Compliance Engine retains remediation evidence for frameworks such as NIS2, ISO 27001, PCI, CISA, and NIST requirements.
End-of-Life Tracking highlights devices whose lifecycle status may prevent a supported firmware remediation path.
SSH Bastion and Credential Vault provide controlled administrative access during investigation and maintenance.
ConnectMyAssets does not replace threat hunting or forensic analysis. It helps infrastructure and security teams establish which assets are affected, preserve configuration evidence, coordinate controlled remediation, and demonstrate completion from an on-prem system of record.
Source: The Hacker News
