The FortiGate implant has no file, no port and no outbound connection. It passes notes between two daemons

Unit 42 published research on 14 October into an implant it calls PEERSTITCH, found on FortiGate firewalls after the compromise of a telecommunications managed service provider. The intrusion it describes happened in September 2024.

The implant is worth reading about for one reason: it breaks the assumptions most firewall hunting is built on.

What it does not have

No binary on disk. No listening port. No outbound connection. Nothing for a network sensor to see leaving the device and nothing for a file scan to find on it.

PEERSTITCH is a 64-bit ARM64 Linux executable statically linked against glibc, which Unit 42 describes as a one-shot process memory patching injector. It runs once, writes itself into two running processes, and the loader unlinks its own binary.

How it gets in and up

Initial access was CVE-2024-47575, the unauthenticated FortiManager flaw in the management channel on TCP 541. The attackers registered a rogue virtual FortiGate named "localhost" and exfiltrated an archive containing the running configurations of more than 500 managed firewalls, two SQLite databases, a serial-number-to-public-IP inventory, routing and topology data, certificates and private keys, and reversibly encrypted administrative, local and VPN credentials.

They brute-forced those recoverable passwords and used them to open VPN sessions. Then, to get from administrative access on FortiOS to root on the underlying system, they used CVE-2025-61624, a path traversal in the auto-script engine. NVD describes it as allowing "an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands". The attackers created an object named with a traversal string to drop the loader.

Note the sequence. The intrusion is dated September 2024. The privilege-escalation flaw was not publicly disclosed by Fortinet until 2026.

The part that is genuinely novel

The loader finds the process IDs of two FortiOS daemons, miglogd, which handles logging, and iked, the IKE and IPsec VPN daemon. For each it reads the memory map, attaches with ptrace, halts the process, snapshots its registers, builds a small ARM64 bootstrap that maps 16 KB of readable, writable and executable memory, and writes a 1,344-byte payload into it. Three instructions are overwritten with NOPs and a 20-byte trampoline redirects execution into the hook.

Then it leaves. There is no further process, no agent, no scheduled task.

The two hooks talk to each other by writing into each other's memory through the proc filesystem. They scan data already passing through their own process for two markers, one of them the string 169.254.0.1, copy a short token into a 16-slot ring buffer, and push it across. In iked, a matching tag lets the hook take an alternate return path that skips default FortiOS validations.

So the command channel is the firewall's own traffic. Unit 42 puts it plainly: PEERSTITCH "communicates through traffic generated by legitimate processes on the infected host". It inspects what is already there rather than opening a socket, which is why there is nothing to see.

This is the same shape as a story we ran last month, where a ransomware crew skipped the CVSS 10.0 bypass and logged in through a hard-coded password scored 5.3. The severity of a flaw and its usefulness to an operator are different measurements.

Everything else was about not being seen

A second persistence mechanism abused Apache's ACME renewal feature, pointing the challenge handler at a binary so that shell commands injected into a domain field launched a reverse shell, with renewal mode keeping it polling.

The anti-forensics list is long: killing the logging daemons, clearing the crash log, an automatic rollback that deleted rogue administrators and the auto-script objects used to get in, a decoy string written over the second mechanism's config, and the loader deleting itself. Unit 42 assesses with medium confidence that the attackers deliberately caused telemetry drops on the management interface.

What to do

• Patch FortiManager for CVE-2024-47575 and FortiOS for CVE-2025-61624 if you somehow have not. Then stop treating that as the answer, because the credentials in that archive are the lasting damage.
• Rotate every credential a compromised FortiManager held, including VPN and local accounts, and replace certificates and private keys. They were stored reversibly and they were taken.
• Hunt in memory, not on disk. Unit 42's markers: an anonymous 16,384-byte read-write-execute region in miglogd or iked in the process memory map, and the NOP instruction pattern at the three patch offsets.
• Audit for one process writing to another's memory through the proc filesystem. Between miglogd and iked there is no legitimate reason for it.
• Search auto-script objects for traversal strings, and crash logs for segmentation faults involving miglogd, iked or syslogd.
• Treat a managed firewall fleet as one blast radius. A management server holding 500 running configurations is a single object that describes every device it manages.

What is not established

• How many firewalls actually received the implant. Unit 42 says the loader was pushed to "a select number of firewalls". The 500-plus figure is configurations exfiltrated, not devices implanted.
• Who did it. The activity is tracked as a cluster, and Unit 42 says only that aspects of the post-exploitation overlap with intrusions attributed to suspected nation-state actors.
• The full command-and-control interface beyond the marker handoff.
• Whether the managed service provider's client networks were compromised. Unit 42 investigated only the provider, and describes client exposure as configuration and credential material rather than confirmed intrusion.
• How long the attackers were in. The dwell time is described only as extended.
• The exact publication date of CVE-2025-61624. Reporting puts Fortinet's advisory in April 2026; we could not read the date off NVD directly and are not asserting it.