23.240.77[.]233IP address
Reported by 2 independent sources · first reported by Palo Alto Unit 42 · last reported
Last reported 8 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions“It includes an auto-script designed to download five components from an external server ("23.240.77[.]233:8085") -”
-
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant“Payload retrieval: The script downloaded five files from hxxp://23.240.77[.]233:8085/ into /data2/template/:”
Indicators reported together
named in the same reports- 45.32.41[.]202in 1 report
- 198.199.122[.]22in 1 report
- system[.]autoin 1 report
- hxxp://23.240.77[.]233:8085/in 1 report
- b9fb0b27ddd59b58…533bb9cd1e70in 1 report
- 829b1cd270b30565…8ae4a0431f11in 1 report
- bd064244dad748cf…febd4c1fe02ain 1 report
- 9c4c4436ff5cdf0d…af7a7110437ein 1 report
- fc1b10c58057ef9f…a6e0312b36eein 1 report
- f84eea718526706a…8249c5e379abin 1 report
- b7ae166fd49a7ecf…fb7d14ce15a8in 1 report
- 8d969eef6ecad3c2…0c923adc6c92in 1 report
- hxxp://23.240.77[.]233:8085/pM.jsin 1 report
- hxxp://47.18.167[.]159:8085/pM.jsin 1 report
Copy these 14 indicators · defanged
Also named with it: CVE-2024-47575, CVE-2025-61624, CVE-2024-26009, CVE-2024-26008, CVE-2025-59718, CVE-2025-59719
Thanks — we review every report.