PEERSTITCH deployment used a second flaw, CVE-2025-61624 — a path-traversal in the FortiOS command-line interpreter affecting FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, patched in April 2026 — and the implant leaves no persistent binary on disk, opens no listening ports and initiates no outbound connections, communicating inside traffic generated by legitimate processes.