India, Oct. 16 -- A firewall can continue processing traffic normally while its underlying security logic has already been compromised. That is precisely what makes PEERSTITCH dangerous. Instead of attacking the firewall from outside, the malware alters legitimate FortiOS processes to bypass security checks for selected VPN sessions.

Discovered by Palo Alto Networks Unit 42, the ARM64 implant emerged during an investigation into a telecommunications managed service provider breached in September 2024. The campaign demonstrates how attackers can turn centralized firewall management access into deeper control over the security infrastructure itself.

The attackers initially exploited CVE-2024-47575 (FortiJump) to compromise FortiManager, F...