A suspected advanced threat group has turned a medium-rated path traversal bug in Fortinet's FortiOS command line interpreter into a durable foothold on network-edge appliances, deploying a previously undocumented, memory-resident ARM64 implant tracked as PEERSTITCH in the process.
What makes the campaign stand out is not the severity rating attached to the underlying flaw but what the attacker did with it: establish a position on a device that brokers trusted remote-access connections, then run VPN sessions that cleared downstream policy checks on tagged traffic — a bypass pattern that, by construction, produces no failure logs for defenders to stumble over.
A 5.4 That Behaved Like a Critical
The flaw, tracked as CVE-2025-61624, carries a CVSS score of 5.4 and affects the CLI component shared across four Fortinet product lines: FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. A path traversal in a management interface is the kind of finding that can easily slide into a routine patch cycle instead of an emergency one.
This campaign shows how badly that triage instinct can miss. However the score reads, the bug handed the attacker a foothold on an appliance sitting at the network boundary — the class of system where compromise propagates furthest into everything the device terminates and routes. The practical lesson for administrators is that an edge-device vulnerability should not be prioritised on its CVSS number alone; deployment context matters as much as the metric.
The Tagged-Session Bypass
The most consequential detail in the research concerns what happened after access was gained. VPN sessions established on the appliance carried tags that satisfied downstream policy checks, causing traffic to be treated as belonging to an approved category without setting off the access controls operators would expect to fire. The result is a bypass that is invisible in the logs: no authentication failure, no policy denial, only traffic quietly waved through.
A careful distinction is needed here, because two separate evasion mechanisms are in play and they defeat different defences. PEERSTITCH's memory-resident design — leaving little for disk scanning, file-integrity monitoring or artefact collection to find — frustrates host-level incident response. The session-tag abuse instead targets how the platform labels and routes traffic, defeating policy enforcement. Conflating the two muddies the detection picture; both must be addressed.
The design lesson extends beyond Fortinet. A session tag is routing metadata, not an identity signal. Where a downstream control trusts a label a session can assert, any attacker who can influence that label inherits the trust. Elevated access decisions should bind to verifiable identity — certificates, tokens, attested posture — rather than to metadata the session itself defines.
Detection and Response
PEERSTITCH is an ARM64 implant built to reside in process memory, sidestepping the default reflexes of most appliance response tooling: there is no file to hash, no persistent artefact to collect, and nothing for integrity monitoring to flag. Detection has to shift to process-memory inspection, behavioural telemetry and network-level indicators of compromise.
A second gap compounds the difficulty. FortiOS appliance logs frequently never reach the central monitoring pipeline that endpoint telemetry feeds into, leaving the only evidence of this activity sitting on the appliance itself, unseen. That log-forwarding blind spot is a general weakness in how edge devices are monitored — not specific to FortiOS or to this campaign — and closing it is a concrete, often-overlooked step: ship appliance logs into the same SIEM that receives endpoint events.
Administrators across the affected product lines should confirm they are running current, vendor-fixed releases and verify post-upgrade status, with Fortinet's official advisory as the authoritative source for per-product fixed versions. Network inspection for anomalous session-tagging behaviour and unexpected memory-resident processes on appliances should follow.
Attribution and Relevance
The researchers behind the report did not tie the campaign to any named threat group, and the indicators alone should not be read as a signature of a specific actor.
The story carries a structural lesson for Hong Kong in particular: Fortinet's appliance portfolio, especially FortiGate running FortiOS, is widely deployed across local enterprises as perimeter and remote-access infrastructure. Organisations in that footprint should treat the combination of an edge-device foothold and a silent policy bypass as a priority review item — regardless of what the severity score suggests.
一個疑似高級持續威脅組織（APT）將Fortinet FortiOS命令行解釋器（CLI）中一個評分屬中等級別的path traversal漏洞，轉化為網絡邊界設備（appliance）上的長期立足點，並在過程中部署了一款此前未有記錄、常駐於記憶體的ARM64植入程式，代號 PEERSTITCH。
是次攻擊行動值得關注之處，並非漏洞本身的嚴重性評分，而是攻擊者如何運用它：在一部負責處理可信遠程接入連線的設備上建立立足點，隨後在帶有特定標籤（tag）的流量上執行VPN會話，使其順利通過下游策略檢查（policy check）——這種繞過模式在設計上便不會產生任何失敗日誌，防守方無從發現。
一個表現如Critical的5.4漏洞
該漏洞編號為 CVE-2025-61624，CVSS評分為5.4，影響四條Fortinet產品線共用的CLI組件：FortiOS、FortiPAM、FortiProxy及FortiSwitchManager。管理介面上的path traversal漏洞，通常很容易被歸入例行修補週期處理，而非緊急應變處理。
是次行動正正暴露了這種分類本能的嚴重失準。不論評分如何，該漏洞讓攻擊者得以在一部身處網絡邊界的設備上立足——這類系統一旦被攻陷，威脅便會沿著該設備終止（terminate）及路由（route）的一切不斷向內蔓延。管理員從中得到的實際教訓是：邊界設備漏洞不應單憑CVSS評分來判斷優先次序，部署環境的重要性與評分指標同等重要。
標籤會話繞過機制
研究中最具影響力的細節，在於攻擊者取得訪問權限後所採取的行動。在該設備上建立的VPN會話帶有特定標籤，足以令下游策略檢查判定其獲批，使相關流量無需觸發營運人員預期會啟動的存取控制機制便獲准通過。結果是一種在日誌上完全隱形的繞過：沒有認證失敗、沒有策略拒絕，只有流量被悄然放行。
此處必須作出明確區分，因為當中涉及兩種不同的規避機制，各自針對不同層面的防禦。PEERSTITCH的記憶體常駐設計令磁碟掃描、檔案完整性監控及證據蒐集幾乎無所發現，窒礙主機層面的事故應對（incident response）；而會話標籤的濫用則針對平台如何為流量加上標籤及進行路由，破壞的是策略執行（policy enforcement）。將兩者混為一談會模糊偵測視野，必須分別應對。
設計層面的教訓不限於Fortinet。會話標籤本質上是路由用的metadata，並非身份憑證。當下游控制機制信任會話自行聲明的標籤時，任何能夠影響該標籤的攻擊者便同時繼承了該份信任。涉及權限提升（elevated access）的決策應綁定於可驗證的身份——例如certificate、token、已驗證的設備安全狀態（attested posture）——而非綁定於會話本身自行定義的metadata。
偵測與應對
PEERSTITCH是一款常駐於進程記憶體（process memory）的ARM64植入程式，避開了大多數設備應對工具的預設反應：沒有檔案可供雜湊（hash）、沒有持久化證據可供收集、亦沒有東西可供完整性監控標記。偵測手段必須轉向進程記憶體檢查、行為遙測（behavioural telemetry）以及網絡層面的入侵指標（IOC）。
第二個盲點令問題更趨複雜。FortiOS設備的日誌經常無法送達接收端點遙測（endpoint telemetry）的中央監控管道，導致此類活動的唯一證據停留在設備本身，無人看見。這種日誌轉發盲點是邊界設備監控模式的普遍弱點，並非FortiOS或是次攻擊行動所獨有；填補此盲點是一項具體而常被忽略的措施：將設備日誌統一送入接收端點事件的同一個SIEM系統。
受影響產品線的管理員應確認正使用廠商已修復漏洞的最新版本，並在升級後核實狀態；各產品的修復版本應以Fortinet官方通告為準。其後應就設備上的異常會話標籤行為及非預期的記憶體常駐進程進行網絡檢查。
歸因與相關性
報告背後的研究人員並未將是次攻擊行動歸因於任何具名威脅組織，相關指標不應被解讀為某特定攻擊者的「signature」。
是次事件對香港尤具結構性意義：Fortinet的設備產品組合，特別是運行FortiOS的FortiGate，在本地企業中被廣泛部署為邊界防護及遠程接入基礎設施。身處此部署範圍內的機構，應將「邊界設備立足點」與「靜默策略繞過」的組合列為優先檢視項目——不論嚴重性評分如何顯示。