Date: 10/15/2026
Severity: High
Summary
Threat actors tracked as CL-STA-0954 (UNC5820) compromised a telecommunications managed service provider by exploiting CVE-2024-47575 (FortiJump) on a centralized FortiManager appliance, stealing configurations, credentials, cryptographic material, and network topology data for more than 500 managed FortiGate firewalls. The attackers subsequently exploited CVE-2025-61624 through FortiOS auto-script path traversal to deploy PEERSTITCH, a novel memory-resident ARM64 implant. PEERSTITCH avoids writing persistent binaries to disk, opening listening ports, or initiating outbound connections, instead communicating through legitimate processes to evade conventional detection. The stolen information also enabled long-term access, VPN session establishment, traffic interception, and backdoor deployment.
Indicators of Compromise (IOC) List
Domains/URLs | http://23.240.77.233:8085/pM.js http://47.18.167.159:8085/pM.js http://23.240.77.233:8084/directory http://23.240.77.233:8084/acme/new-acct http://23.240.77.233:8084/acme/order/11111 http://23.240.77.233:8084/acme/authz/1 http://23.240.77.233:8084/acme/finalize/61924744/774083503 |
IP Address | 23.240.77.233 47.18.167.159 45.32.41.202 198.199.122.22 |
Hash | b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70
829b1cd270b30565739a478441833f49f10a49bd06f0d18cc96c8ae4a0431f11
bd064244dad748cf2a44074bee56f5bfab4a2b18ee944b75d1b3febd4c1fe02a
9c4c4436ff5cdf0d6d68f5108031cbf3708a095cde4ef8c09316af7a7110437e
fc1b10c58057ef9f1f9a1e2a3d4a1c89f43b0ead451398c70ed7a6e0312b36ee
f84eea718526706afdf2d1a2774fab76ecb11c18fb61995a37be8249c5e379ab
b7ae166fd49a7ecfe6322a80b8aa56d6aa0825d8f5d106dab2e4fb7d14ce15a8
8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "http://23.240.77.233:8084/directory" or url like "http://23.240.77.233:8084/directory" or siteurl like "http://23.240.77.233:8084/directory" or domainname like "http://47.18.167.159:8085/pM.js" or url like "http://47.18.167.159:8085/pM.js" or siteurl like "http://47.18.167.159:8085/pM.js" or domainname like "http://23.240.77.233:8085/pM.js" or url like "http://23.240.77.233:8085/pM.js" or siteurl like "http://23.240.77.233:8085/pM.js" or domainname like "http://23.240.77.233:8084/acme/authz/1" or url like "http://23.240.77.233:8084/acme/authz/1" or siteurl like "http://23.240.77.233:8084/acme/authz/1" or domainname like "http://23.240.77.233:8084/acme/order/11111" or url like "http://23.240.77.233:8084/acme/order/11111" or siteurl like "http://23.240.77.233:8084/acme/order/11111" or domainname like "http://23.240.77.233:8084/acme/new-acct" or siteurl like "http://23.240.77.233:8084/acme/new-acct" or url like "http://23.240.77.233:8084/acme/new-acct" or domainname like "http://23.240.77.233:8084/acme/finalize/61924744/774083503" or siteurl like "http://23.240.77.233:8084/acme/finalize/61924744/774083503" or url like "http://23.240.77.233:8084/acme/finalize/61924744/774083503" |
Detection Query 2 : | dstipaddress IN ("23.240.77.233","47.18.167.159","198.199.122.22","45.32.41.202") or srcipaddress IN ("23.240.77.233","47.18.167.159","198.199.122.22","45.32.41.202") |
Detection Query 3 : | sha256hash IN ("b7ae166fd49a7ecfe6322a80b8aa56d6aa0825d8f5d106dab2e4fb7d14ce15a8","b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70","829b1cd270b30565739a478441833f49f10a49bd06f0d18cc96c8ae4a0431f11","bd064244dad748cf2a44074bee56f5bfab4a2b18ee944b75d1b3febd4c1fe02a","9c4c4436ff5cdf0d6d68f5108031cbf3708a095cde4ef8c09316af7a7110437e","fc1b10c58057ef9f1f9a1e2a3d4a1c89f43b0ead451398c70ed7a6e0312b36ee","f84eea718526706afdf2d1a2774fab76ecb11c18fb61995a37be8249c5e379ab","8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92")
|
Reference:
Forti Manager Supply Chain Attack