---
title: Hunt: PEERSTITCH on FortiGate (RWX mmap in miglogd/iked, auto-script ../../../../setup, ACME md-acme.conf) | ctxsec
url: https://ctxsec.com/items/hunt-peerstitch-fortigate
description: ""
status: "hunt idea (vendor research)"
published: 2026-10-15
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-peerstitch-fortigate.md)

hunt idea (vendor research)

2026-10-15

### Hunt: PEERSTITCH on FortiGate (RWX mmap in miglogd/iked, auto-script ../../../../setup, ACME md-acme.conf)

From Unit 42's table: 1) On ARM64 FortiGates, inspect `/proc/<pid>/maps` for `miglogd`/`iked` for anonymous **16384-byte rwxp** regions. 2) Check text integrity at base+0x106F7B8 / 0x1072E20 / 0x109A570 for NOP-like `0xAA0003E0` (MOV X0,X0). 3) Audit syscall telemetry for open/write to `/proc/*/mem` between those daemons. 4) `diagnose debug crashlog read` for Signal 11 involving miglogd/iked/syslogd. 5) Config revisions for `system.auto-script` names containing `../` (esp. `../../../../setup`) and `../../tmp/apache2/conf/md-acme.conf`. Filenames: `lldprx`, `pM.js`, `index.js`/`index.wasm`, `ipssem.js`. Sample SHA-256 core injector: `b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70`. Staging IPs historically include 23.240.77[.]233 and 47.18.167[.]159. After any FortiManager compromise, rotate FGFM trust material and treat stolen configs as credential dumps.

Sources: [Unit 42: PEERSTITCH FortiGate implant](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)