FortiOS VPN Exploit Lets PEERSTITCH Malware Hide in Legitimate Processes and Bypass Checks
Attackers have exploited a FortiOS flaw after breaching FortiManager to deploy PEERSTITCH, a memory-resident implant that hides inside legitimate FortiOS processes and can slip past security checks on specially tagged VPN sessions.
A newly detailed attack on Fortinet infrastructure shows how a flaw in FortiOS can be turned into a covert entry point into corporate and government networks.
According to research highlighted by The Hacker News, attackers first compromised FortiManager, Fortinet’s centralized management product, and then used a FortiOS vulnerability to install a memory‑resident implant known as PEERSTITCH. The malware runs inside legitimate FortiOS processes.
Because PEERSTITCH is embedded in trusted processes in memory rather than sitting on disk as a separate executable, it can evade many standard security tools. The report notes that the implant is able to bypass security checks on virtual private network sessions that carry special tags.
In practice, that means hostile operators can use specific VPN connections to move data in and out of a target environment under the cover of what appears to be normal, encrypted remote access. The edge devices that many organizations rely on to enforce security controls are, in these cases, being turned into channels for hidden activity.
FortiOS‑based products sit in front of many enterprise and public‑sector networks. Once attackers gain this foothold, they can observe traffic patterns and seek ways to move further inside toward more sensitive systems.
The immediate test for defenders is how quickly they can apply fixes, audit their FortiManager installations, and examine logs for unusual VPN behavior linked to specially tagged sessions. Any attribution of PEERSTITCH to particular threat actors would sharpen how governments and regulators respond if it turns out that critical systems have been exposed through their own perimeter devices.
Sources
- OSINT