Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
2026-10-15T08:51:31Z•a3a34cedc4393723601f87a94fe886947429217b5b0dee9cae043f49ec921ce6
CVE-2024-47575CVE-2026-88771CVE-2026-88772ARM64 malwareFortiGateFortiManagerFortinetIran-nexus threat activityKubernetesNetScalerPEERSTITCHcloud securitycredential theftcritical infrastructureidentity abusemacOS infostealermemory-resident malwaresupply-chain attackszero-day exploitation
What happened
Unit 42 reports an intrusion campaign that exploited Fortinet FortiManager vulnerability CVE-2024-47575 to compromise more than 500 firewalls and deploy PEERSTITCH, a stealthy memory-resident ARM64 implant. The broader feed also covers active exploitation of NetScaler zero-days, cloud and Kubernetes identity abuse, supply-chain attacks, malware campaigns, and targeted critical-infrastructure operations.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- paloalto_unit42
- Record identifier
- a3a34cedc4393723601f87a94fe886947429217b5b0dee9cae043f49ec921ce6
- Enrichment time
- 2026-10-15T08:51:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.