suspected advanced threat actor

PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses VPN Session Checks

A suspected advanced threat actor has been observed exploiting a path traversal vulnerability in Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager to deploy a previously unreported memory-resident ARM64 malware strain known as PEERSTITCH. The flaw (CVSS 5.4) resides in the command line interpreter and allows unauthorized file access, with attackers bypassing security checks on tagged VPN sessions. Patches have been released by Fortinet.