PEERSTITCH Malware Deployed via FortiOS Vulnerability

Summary: An advanced threat actor exploited a Fortinet FortiOS vulnerability to deploy a new ARM64 malware called PEERSTITCH. This malware is capable of bypassing checks on tagged VPN sessions.

This news reports that an advanced threat actor exploited a security flaw in Fortinet FortiOS to deploy a new malware called PEERSTITCH. The technical background suggests a vulnerability in FortiOS’s mechanisms for tagging VPN sessions and applying security checks based on these tags. This vulnerability allows the malware to bypass these controls.

PEERSTITCH is described as a memory-resident ARM64 malware. Such malware can be difficult to detect as it doesn’t leave persistent traces on disk. The FortiOS vulnerability is likely a remote code execution or similar flaw, allowing the attacker to load PEERSTITCH directly into memory on the device. Bypassing checks on tagged VPN sessions leads to the circumvention of network segmentation and access control policies.

For live systems and infrastructure, this situation poses a critical risk for organizations using Fortinet devices. There is a high potential for infiltration into internal networks, especially via VPN access. Operationally, FortiOS devices urgently need to be updated, and network traffic requires deeper inspection.

Infrastructure engineers must promptly apply the latest patches for Fortinet devices and review their network segmentation policies. Additionally, evaluating advanced endpoint detection and response (EDR) or network traffic analysis (NTA) solutions capable of detecting memory-resident malware would be beneficial.

🔗 Source: The Hacker News
📡 Authoritative feeds & live tracking: Radar