unit42 · Crawled Oct 18, 2026
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
20 IoCs 1 Actors
Read original article ↗
AI Summary
Unit 42 uncovered a sophisticated network intrusion campaign tracked as CL-STA-0954, targeting a telecommunications organization via exploitation of CVE-2024-47575 (FortiJump) on a FortiManager appliance. Attackers exfiltrated configuration data, credentials, and cryptographic material for over 500 managed FortiGate firewalls. They later exploited CVE-2025-61624 to deploy PEERSTITCH, a novel memory-resident ARM64 malware that evades detection by patching running processes and establishing covert inter-process communication. The implant enables traffic interception, backdoor access, and privilege escalation without writing to disk or opening network ports.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 20 extracted
| Type | Value | Detail |
|---|---|---|
| IP | 23[.]240[.]77[.]233 | Details → |
| IP | 47[.]18[.]167[.]159 | Details → |
| IP | 45[.]32[.]41[.]202 | Details → |
| IP | 198[.]199[.]122[.]22 | Details → |
| SHA-256 | b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70 | Details → |
| SHA-256 | 829b1cd270b30565739a478441833f49f10a49bd06f0d18cc96c8ae4a0431f11 | Details → |
| SHA-256 | bd064244dad748cf2a44074bee56f5bfab4a2b18ee944b75d1b3febd4c1fe02a | Details → |
| SHA-256 | 9c4c4436ff5cdf0d6d68f5108031cbf3708a095cde4ef8c09316af7a7110437e | Details → |
| SHA-256 | fc1b10c58057ef9f1f9a1e2a3d4a1c89f43b0ead451398c70ed7a6e0312b36ee | Details → |
| SHA-256 | f84eea718526706afdf2d1a2774fab76ecb11c18fb61995a37be8249c5e379ab | Details → |
| SHA-256 | b7ae166fd49a7ecfe6322a80b8aa56d6aa0825d8f5d106dab2e4fb7d14ce15a8 | Details → |
| SHA-256 | 8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92 | Details → |
| Filename | lldprx | Details → |
| Filename | pM.js | Details → |
| Filename | index.wasm | Details → |
| Filename | ipssem.js | Details → |
| Filename | ../../../../setup | Details → |
| Filename | ../../tmp/apache2/conf/md-acme.conf | Details → |
| Domain | 23[.]240[.]77[.]233 | Details → |
| Domain | 47[.]18[.]167[.]159 | Details → |
MITRE ATT&CK TTPs 17 techniques
T1055 Process Injection · Defense Evasion T1055.005 Thread Local Storage · Defense Evasion T1070.004 File Deletion · Defense Evasion T1070.006 Timestomp · Defense Evasion T1134 Access Token Manipulation · Defense Evasion T1548 Abuse Elevation Control Mechanism · Privilege Escalation T1548.001 Setuid and Setgid · Privilege Escalation T1552 Unsecured Credentials · Credential Access T1552.001 Credentials In Files · Credential Access T1566 Phishing · Initial Access T1566.001 Spearphishing Attachment · Initial Access T1571 Non-Standard Port · Command And Control T1572 Protocol Tunneling · Command And Control T1574 Hijack Execution Flow · Persistence T1574.002 DLL Side-Loading · Persistence T1588 Obtain Capabilities · Resource Development T1588.001 Malware · Resource Development