TF-MAL-elf.peerstitch
📛 Threat Title
Malware family: PEERSTITCH
Description
ThreatFox malware family `elf.peerstitch`. Printable name: PEERSTITCH.
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:cybersecuritynews.com
Attackers compromised a telecommunications managed service provider by exploiting vulnerabilities in Fortinet's centralized management and firewall systems, then deployed PEERSTITCH , a stealthy malware implant that runs inside FortiGate processes. Unit 42 says the activity began with a breach of a FortiManager appliance and exposed configurations and sensitive data linked to more than 500 ...
-
web:cyfar.ca
Unit 42 Uncovers PEERSTITCH , a Stealthy FortiGate Implant PEERSTITCH is a memory-resident ARM64 implant deployed via FortiManager CVE-2024-47575 and FortiOS CVE-2025-61624, targeting 500+ managed FortiGate firewalls at a telecom MSP.
-
web:dev.to
14. Unresolved Questions and Further Investigation Whether the attackers entered the individual customer networks associated with the 500+ devices, their ultimate objective, and formal threat-actor attribution remain unconfirmed. 15. Impact on SOCs and Organizations A compromise of centralized management can expose configurations and keys for firewalls protecting numerous customers. Memory ...
-
web:hacklido.com
PEERSTITCH Malware Targets Fortinet Devices Using Stealthy In-Memory Code Injection A suspected advanced threat actor has been observed exploiting a Fortinet security vulnerability to deploy a previously undocumented, memory-resident malware known as PEERSTITCH on ARM64-based devices. The malware operates directly in process memory, avoids leaving persistent binaries on disk, and uses ...
-
web:thedailytechfeed.com
A new malware strain called PEERSTITCH has been uncovered exploiting a Fortinet FortiOS vulnerability to conduct sophisticated, stealthy attacks that bypass security checks on tagged VPN sessions. The Vulnerability & Attack Vector The exploit hinges on CVE-2025-61624, a path traversal issue embedded in FortiOS's command-line interpreter components including FortiPAM, FortiProxy, and ...
-
web:thehackernews.com
Attackers exploited a patched FortiOS flaw to deploy PEERSTITCH , a memory-resident implant that bypasses checks on tagged VPN sessions.
-
web:unit42.paloaltonetworks.com
We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH , a memory-resident ARM64 malware .
-
web:www.modernendpoint.tech
Unit 42 has documented a memory-resident malware implant called PEERSTITCH , deployed via CVE-2025-61624 in FortiOS, that hooks two FortiOS daemons to bypass VPN session security checks without leaving a persistent binary on disk. Security and endpoint teams managing Fortinet infrastructure need to assess whether their detection coverage would catch this technique. Action requiredDefender2026 ...
-
web:www.pcquest.com
A firewall can continue processing traffic normally while its underlying security logic has already been compromised. That is precisely what makes PEERSTITCH dangerous. Instead of attacking the firewall from outside, the malware alters legitimate FortiOS processes to bypass security checks for selected VPN sessions.
-
web:www.verisq.ai
PEERSTITCH Malware Delivered via FortiOS Path‑Traversal Flaw (CVE‑2025‑61624) Bypasses VPN Session Checks What It Is - A newly‑identified ARM64 memory‑resident malware family , PEERSTITCH , is being dropped by threat actors who exploit a path‑traversal bug (CVE‑2025‑61624) in Fortinet's FortiOS, FortiPAM, FortiProxy and FortiSwitchManager.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.