Act
active
PEERSTITCH Malware Exploits FortiOS Path Traversal CVE-2025-61624
- Engineer — Act: Active exploitation of CVE-2025-61624 on FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager is confirmed; patch all affected Fortinet products immediately and audit edge device logs for signs of PEERSTITCH deployment.
- SOC/IR — Act: Memory-resident malware on edge devices evades most endpoint controls — assume compromise if Fortinet appliances are in scope; hunt for anomalous outbound traffic or process anomalies on FortiOS devices and sweep for PEERSTITCH IOCs published with this campaign.
- Leader — Plan: Advanced actor activity against widely deployed Fortinet edge infrastructure warrants confirming this quarter whether all Fortinet appliances are patched and whether incident response runbooks cover memory-resident implants on network devices.
- Signals: CVE-2025-61624 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.