PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

A sophisticated threat actor, tracked as CL-STA-0954 (UNC5820), exploited a path traversal vulnerability (CVE-2025-61624) in FortiOS to deploy a memory-resident malware called PEERSTITCH. The attackers exfiltrated a significant amount of sensitive data, including configuration files, cryptographic material, and database information, and attempted to erase forensic evidence to maintain persistent access.