Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
18 IOCs
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
Threat Actors
Malware Families
Excerpt
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant Menu Tools ATOMs Security Consulting About Us Under Attack? Threat Research Center Threat Research Malware Malware Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant 14 min read Related Products Advanced DNS Security Advanced IP Defense Advanced Threat Prevention Advanced URL Filtering Advanced WildFire Cloud-Delivered Security Services Cortex Cortex Xpanse IoT Security Next-Generation Firewall Unit 42 Incident…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(4)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →18 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 198.199.122.22 | High | Score 58/100 | First seen |
| SHA256 | 9c4c4436ff5cdf0d6d68f5108031cbf3708a095cde4ef8c09316af7a7110437e | Medium | Score 53/100 | First seen |
| SHA256 | fc1b10c58057ef9f1f9a1e2a3d4a1c89f43b0ead451398c70ed7a6e0312b36ee | Medium | Score 53/100 | First seen |
| CVE | CVE-2024-47575 | High | Score 63/100 | First seen |
| CVE | CVE-2024-26008 | Medium | Score 51/100 | First seen |
| SHA256 | bd064244dad748cf2a44074bee56f5bfab4a2b18ee944b75d1b3febd4c1fe02a | Medium | Score 53/100 | First seen |
| IP | 47.18.167.159 | High | Score 58/100 | First seen |
| SHA256 | f84eea718526706afdf2d1a2774fab76ecb11c18fb61995a37be8249c5e379ab | Medium | Score 53/100 | First seen |
| SHA256 | b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70 | Medium | Score 53/100 | First seen |
| SHA256 | b7ae166fd49a7ecfe6322a80b8aa56d6aa0825d8f5d106dab2e4fb7d14ce15a8 | Medium | Score 53/100 | First seen |
| CVE | CVE-2024-26009 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-61624 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-59718 | Medium | Score 59/100 | First seen |
| IP | 45.32.41.202 | High | Score 58/100 | First seen |
| IP | 23.240.77.233 | High | Score 58/100 | First seen |
| SHA256 | 829b1cd270b30565739a478441833f49f10a49bd06f0d18cc96c8ae4a0431f11 | Medium | Score 53/100 | First seen |
| SHA256 | 8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92 | Medium | Score 53/100 | First seen |
| CVE | CVE-2025-59719 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…