PEERSTITCH malware exploits Fortinet FortiOS flaw to hide communications

Attackers used a FortiOS flaw to install PEERSTITCH, a newly identified malware that runs in memory on Fortinet devices.

Researchers found it during an investigation into a prolonged intrusion at a telecommunications managed service provider.

The attackers first exploited a separate FortiManager flaw to steal configurations, credentials and other data linked to more than 500 managed FortiGate firewalls.

They used the stolen information to explore networks and maintain access before exploiting a FortiOS path traversal flaw to deploy the malware.

PEERSTITCH injects code into legitimate FortiOS processes and leaves no permanent file or listening port, making it harder to detect.

Fortinet patched the exploited flaw in April 2026, but the discovery highlights the risk that a breach of a central management system can expose connected networks.