# Attackers exploit FortiOS flaw with PEERSTITCH malware to hide inside VPN traffic

*Friday, October 16, 2026 at 6:12 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-10-16T06:12:53.108Z (1h ago)
**Category**: cyber | **Region**: Global
**Importance**: 7/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/20685.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: A recently detailed campaign shows attackers breaching FortiManager, exploiting a FortiOS vulnerability, and installing the memory-resident PEERSTITCH implant inside legitimate FortiOS processes. By piggybacking on specially tagged VPN sessions, they can move through networks while evading standard checks.

A new account from security researchers describes how attackers used a flaw in Fortinet’s FortiOS to gain deep, covert access to networks that trust Fortinet equipment for protection.

According to the report, the attackers first compromised FortiManager, the centralized management system for Fortinet firewalls and related devices. From that foothold they exploited a FortiOS vulnerability and deployed a memory-resident implant known as PEERSTITCH onto FortiGate devices.

PEERSTITCH runs inside legitimate FortiOS processes rather than as a separate file on disk. That design makes it harder for conventional security tools to spot, because it blends into the operating system that already controls firewall and VPN functions.

The attackers then used specially tagged virtual private network sessions to conceal their activity. By marking certain VPN tunnels so that FortiOS relaxed or bypassed some checks, they pushed command-and-control traffic through connections that administrators normally treat as trusted paths into internal systems.

For organizations that rely on Fortinet firewalls and VPNs, this technique turns a core security appliance into an access point for intruders. A compromised device at the network edge can see and influence large volumes of traffic and often holds privileged routes to internal servers and services.

The people most affected inside these organizations may never see visible signs that anything is wrong. Employees continue to log in and use corporate applications as usual, while attackers watch credentials pass through the VPN and quietly explore internal systems.

From a strategic perspective, the campaign fits a wider move by well-resourced attackers toward living off existing administrative tools and infrastructure instead of deploying obvious malware. By starting with FortiManager and FortiOS, they use the same management channels that network teams rely on, at scale.

The critical questions now are how quickly administrators patch affected FortiOS versions, whether investigators find additional variants of PEERSTITCH on other networks, and if regulators or governments push for closer monitoring of widely deployed network appliances in sensitive sectors.