Attackers exploit FortiOS flaw with ‘PEERSTITCH’ malware to hide inside VPN traffic
Attackers have used a FortiOS vulnerability to deploy a memory‑resident implant called PEERSTITCH after breaching Fortinet’s FortiManager system, letting the malware run inside legitimate processes and bypass checks on specially tagged VPN sessions.
A newly detailed attack on Fortinet devices shows how intruders are exploiting a FortiOS vulnerability and turning core security infrastructure into a covert entry point.
According to research cited in a 16 October report, attackers first breached FortiManager, Fortinet’s centralized management platform, then used a FortiOS flaw to deploy a memory‑resident implant known as PEERSTITCH. This malware hides inside legitimate FortiOS processes on affected devices.
By operating within trusted processes, PEERSTITCH can evade many routine security checks. The research notes that the implant can bypass inspections on specially tagged virtual private network (VPN) sessions, providing attackers with a channel that looks like normal encrypted traffic.
Because the implant resides in memory rather than being written to disk, it leaves fewer persistent traces and can be harder for standard defenses to identify. Attackers who retain access to FortiManager can re‑deploy it or use that foothold to push other malicious changes across a fleet of devices.
For organizations that use Fortinet equipment at the edge of their networks, a successful PEERSTITCH deployment turns a defensive asset into a weakness. FortiGate firewalls running FortiOS often sit in front of sensitive systems, manage VPN links for remote sites and enforce segmentation. If compromised through FortiManager and the described flaw, these same devices can give attackers a path deeper into internal networks.
The case underlines a wider trend in advanced intrusions: targeting security tools themselves. Firewalls, VPN concentrators and management consoles offer visibility into large parts of a network but often receive less monitoring than user endpoints. Once an attacker controls them, they can manipulate or silently pass traffic and configurations.
Defenders using Fortinet products will need to check whether their FortiOS versions are patched against the exploited vulnerability, review who can access FortiManager and look for anomalies in VPN behavior, especially sessions with unusual tagging or that appear to bypass expected inspection.
Vendors are likely to face questions over patch availability, hardening guidance and detection support related to the techniques described in the research. Enterprises that concentrate their firewalls, VPNs and management tools with one provider may also revisit that approach, given the risk that a single flaw can have broad consequences.
Key developments to watch include any advisories from Fortinet or national cybersecurity agencies on this activity, publication of detection rules that security teams can use to hunt for PEERSTITCH, and signs that similar methods are being tested against other network and security platforms.
Sources
- OSINT