The FortiGate implant has no file, no port and no outbound connection. It passes notes between two daemons
2026-10-16Security
Unit 42's PEERSTITCH is a 1,344-byte payload living in the memory of two FortiOS processes. It never calls home. It reads markers out of traffic the firewall was already handling, and writes tags into the other daemon's memory.