A suspected advanced threat actor has been observed exploiting CVE-2025-61624, a path traversal flaw in Fortinet FortiOS, to deploy a previously undocumented memory-resident ARM64 malware named PEERSTITCH. This sophisticated malware bypasses checks on tagged VPN sessions. Unit 42’s analysis indicates that over 500 FortiGate firewalls were targeted, highlighting the critical importance of patching edge devices and monitoring for stealthy implants.