A suspected threat actor has been observed exploiting a vulnerability in Fortinet software to deploy a previously unreported malware strain called PEERSTITCH. According to the reported findings, the malware is memory-resident and targets ARM64 environments, which is notable because many security and networking appliances run on embedded architectures rather than standard desktop or server platforms.

For businesses in Europe, the development matters less because of the malware name itself and more because it affects perimeter infrastructure: firewalls, VPN gateways, proxies and access-management systems. These systems often sit at the edge of a company network and, if compromised, can provide attackers with a strong foothold.

What happened

The reported attack involves exploitation of CVE-2025-61624, described as a path traversal flaw in the command line interpreter of several Fortinet products, including FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. The source report says the issue could allow an attacker to execute unauthorized code or commands under certain conditions.

The attackers were observed using the flaw to deploy PEERSTITCH, a previously unreported malware family. The report describes the malware as memory-resident, which generally means it is designed to run without relying heavily on files stored on disk. That can make detection and forensic analysis harder, especially on specialised appliances where endpoint monitoring is more limited than on laptops or servers.

The source also references tagged VPN sessions in the attack context. For businesses, that points to possible abuse of trusted remote-access or network segmentation mechanisms, though organisations should rely on vendor advisories and incident-response guidance for the exact technical scope.

Why it matters for European businesses

Fortinet products are widely used across SMEs, larger enterprises and managed service environments in Europe. When a vulnerability affects internet-facing security appliances, the risk can extend beyond a single device.

• Perimeter compromise can become broader compromise: If attackers gain access through a firewall, VPN or proxy, they may be able to pivot into internal systems, intercept traffic or maintain persistence.
• Detection may be more difficult: Memory-resident malware and appliance-focused attacks can be harder to identify using standard endpoint security tools.
• Operational impact can be high: Even if no data theft is confirmed, emergency patching, device isolation and incident investigation can interrupt remote access and business operations.
• Compliance implications may follow: Businesses in regulated sectors may need to assess whether a security incident affects reporting obligations under applicable contractual, sectoral or data-protection requirements.

This is particularly relevant for organisations that depend on Fortinet infrastructure for branch connectivity, remote work, partner access or managed network security.

Who may be affected

The most exposed organisations are those using affected Fortinet products, especially where the devices are internet-facing or used to handle remote access and privileged connectivity.

• SMEs with FortiGate or related Fortinet appliances managing office connectivity
• E-commerce businesses that depend on secure perimeter infrastructure for uptime and customer transactions
• IT teams operating VPN, proxy or privileged-access systems
• Managed service providers and digital agencies administering Fortinet environments for clients
• Regulated businesses where compromise of network controls can create audit, resilience or incident-reporting concerns

What companies should consider

Organisations using Fortinet products should review official Fortinet security advisories and confirm whether any deployed products are affected by CVE-2025-61624. Because the source describes active exploitation, response speed matters.

• Identify exposure: Inventory FortiOS, FortiPAM, FortiProxy and FortiSwitchManager deployments, especially externally accessible systems.
• Apply vendor guidance: Check for available patches, mitigations or configuration recommendations from Fortinet and implement them according to change-control procedures.
• Review logs and access activity: Investigate unusual administrative actions, command execution, VPN session anomalies and unexpected configuration changes.
• Strengthen monitoring around appliances: Ensure perimeter devices are included in security monitoring and not treated as isolated black boxes.
• Prepare for incident response: If compromise is suspected, preserve logs, isolate affected systems where feasible and involve internal or external incident-response specialists.
• Reassess appliance security posture: Limit management exposure, enforce strong administrator authentication and review segmentation between perimeter devices and internal systems.

For European SMEs, the broader lesson is that security appliances require the same patch discipline and monitoring attention as servers and cloud services. Devices intended to protect the network can also become high-value entry points when vulnerabilities are exploited.