Nation-state-level actors exploited CVE-2024-47575 against a telecom managed service provider's FortiManager, then deployed PEERSTITCH, a novel memory-resident ARM64 implant that leaves no binary on disk, opens no ports, and hides inside legitimate FortiOS daemon memory. Key findings: - Initial access via CVE-2024-47575 (FortiJump), which allows unauthenticated RCE through crafted requests to the FMG-Access management channel on TCP port 541. The attackers registered a rogue virtual FortiGate named localhost (serial FMG-VMTM23017412) from 45.32.41[.]202, then exfiltrated a configuration archive containing running configs, SQLite databases (global.db and revinfo.db), serial numbers and public IP addresses for more than 500 managed FortiGate firewalls, and ciphertext credentials that were confirmed recoverable via brute force. The scope extended beyond the provider: those firewalls protected client networks the provider managed. - Privilege escalation via CVE-2025-61624, a path traversal in the FortiOS CLI auto-script engine. The auto-script object name field accepts traversal sequences without sanitization, so an authenticated super_admin can write arbitrary files as root outside the intended directory. The attackers used the object name ../../../../setup to drop the PEERSTITCH loader, escaping the restricted FortiOS management shell and gaining root on the underlying OS. - PEERSTITCH (lldprx, SHA-256 b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70) is a 64-bit ARM64 ELF injector that uses ptrace(PTRACE_SEIZE) to attach to /bin/miglogd and /bin/iked, allocates a 16 KB RWX anonymous mmap region in each, and writes a 1,344-byte hook payload. The hook uses strstr() to watch for traffic patterns containing TCP port marker 8550 and IP marker 169.254.0.1, extracts session tokens into a 16-slot ring buffer at offset +0x0F0, and forwards them cross-process via open/lseek/write on /proc/counterpart_pid/mem. Three NOP patches (0xAA0003E0, MOV X0, X0) are written to base+0x106F7B8, base+0x1072E20, and base+0x109A570 to suppress tamper detection. No persistent file, no listening socket, no outbound connection. Staged from hxxp[:]//23.240.77[.]233:8085/ and hxxp[:]//47.18.167[.]159:8085/. - Parallel C2 via Apache mod_md ACME abuse: the attackers pushed a path-traversal auto-script to write ../../tmp/apache2/conf/md-acme.conf, mapping the MDChallengeDns01 handler to /bin/node. Apache's continuous MDRenewMode always polling loop re-executed a reverse shell (SSH to kali@23.240.77[.]233:8084) on every certificate renewal cycle. Anti-forensics were systematic: killall -9 miglogd and killall -9 syslogd before script execution, diagnose debug crashlog clear to wipe Signal 11 crash evidence, automatic rollback of rogue accounts and auto-script objects, lldprx self-unlinking from disk, and overwriting md-acme.conf with the decoy string "#0 certs managed by ACME". - The attackers also impersonated the FortiManager platform over TCP port 541 using exfiltrated FGFM trust material, pulling full configs from managed firewalls under a fabricated account named FortiGateCloud. Packet capture rules were pushed to downstream firewalls targeting RADIUS (UDP 1812/1813), LDAP (TCP 389), TFTP (UDP 69), and a range of telecom services on TCP ports 3696-3706 to intercept credentials and enumerate topology. CVE-2024-26009 and CVE-2024-26008 are assessed with medium confidence as facilitating FGFM session manipulation. Practitioner takeaway: Detection requires hunting volatile memory, not disk. On any potentially affected FortiGate, inspect /proc/miglogd/maps and /proc/iked/maps for anonymous rwxp regions of exactly 16,384 bytes. Audit syscall telemetry for cross-PID write() calls into /proc/pid/mem between those two daemons. Run diagnose debug crashlog read and look for Signal 11 crashes involving miglogd, iked, or syslogd, the attackers cleared these but the clearing action itself is a detection signal. Check all FortiOS system.auto-script objects for names containing ../ traversal strings. Treat the exfiltrated FGFM trust material as compromised for every enrolled downstream device: rotate certificates and credentials before trusting restored management connectivity. The Unit 42 report includes a YARA rule (u42_apt_linux_PEERSTITCH_fortigate_implant), eight SHA-256 hashes, and a full network IOC table. #DFIR_Radar