Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE18 IOCs
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
Threat Actors
Malware Families
Diamond Model
Adversary(2)
Infrastructure(4)
Capability(2)
Victim
Indicators of Compromise
Indicators of Compromise18
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 198.199.122.22 exfiltrationintel-blogmalware | High | 58 | Oct 15, 26 |
| SHA256 | 9c4c4436ff5cdf0d6d68f5108031cbf3708a095cde4ef8c09316af7a7110437e file-hashintel-blogmalware | Medium | 53 | Oct 15, 26 |
| SHA256 | fc1b10c58057ef9f1f9a1e2a3d4a1c89f43b0ead451398c70ed7a6e0312b36ee file-hashintel-blogmalware | Medium | 53 | Oct 15, 26 |
| CVE | CVE-2024-47575 exfiltrationexploitintel-blog | Medium | 56 | Aug 26, 26 |
| CVE | CVE-2024-26008 exploitintel-blogmalware | Medium | 51 | Oct 15, 26 |
| SHA256 | bd064244dad748cf2a44074bee56f5bfab4a2b18ee944b75d1b3febd4c1fe02a file-hashintel-blogmalware | Medium | 53 | Oct 15, 26 |
| IP | 47.18.167.159 exploitintel-blogmalware | High | 58 | Oct 15, 26 |
| SHA256 | f84eea718526706afdf2d1a2774fab76ecb11c18fb61995a37be8249c5e379ab file-hashintel-blogmalware | Medium | 53 | Oct 15, 26 |
| SHA256 | b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70 file-hashintel-blogmalware | Medium | 53 | Oct 15, 26 |
| SHA256 | b7ae166fd49a7ecfe6322a80b8aa56d6aa0825d8f5d106dab2e4fb7d14ce15a8 file-hashintel-blogmalware | Medium | 53 | Oct 15, 26 |
| CVE | CVE-2024-26009 exfiltrationexploitintel-blog | Medium | 51 | Oct 15, 26 |
| CVE | CVE-2025-61624 exploitintel-blogmalware | Medium | 51 | Oct 15, 26 |
| CVE | CVE-2025-59718 exploitintel-blogmalware | Medium | 56 | Jun 15, 26 |
| IP | 45.32.41.202 exfiltrationintel-blogmalware | High | 58 | Oct 15, 26 |
| IP | 23.240.77.233 exfiltrationexploitintel-blog | High | 58 | Oct 15, 26 |
| SHA256 | 829b1cd270b30565739a478441833f49f10a49bd06f0d18cc96c8ae4a0431f11 file-hashintel-blogmalware | Medium | 53 | Oct 15, 26 |
| SHA256 | 8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92 file-hashintel-blogmalware | Medium | 53 | Oct 15, 26 |
| CVE | CVE-2025-59719 exploitintel-blogmalware | Medium | 53 | Jun 15, 26 |
IOC Relationship Graph
IOC Relationship Graph18 total IOCs
IPSHA256CVE