45.32.41[.]202IP address
Reported by 1 independent source · first reported by Palo Alto Unit 42 · last reported
Last reported 10 days ago
What the reports say
1 report, newest first · the exact sentence from each-
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant“…d localhost (serial number FMG-VMTM23017412) to the central FortiManager instance, originating from external attacker infrastructure (45.32.41[.]202, later modified to 198.199.122.22).”
Indicators reported together
named in the same reports- 198.199.122[.]22in 1 report
- system[.]autoin 1 report
- hxxp://23.240.77[.]233:8085/in 1 report
- 23.240.77[.]233in 1 report
- b9fb0b27ddd59b58…533bb9cd1e70in 1 report
- 829b1cd270b30565…8ae4a0431f11in 1 report
- bd064244dad748cf…febd4c1fe02ain 1 report
- 9c4c4436ff5cdf0d…af7a7110437ein 1 report
- fc1b10c58057ef9f…a6e0312b36eein 1 report
- f84eea718526706a…8249c5e379abin 1 report
- b7ae166fd49a7ecf…fb7d14ce15a8in 1 report
- 8d969eef6ecad3c2…0c923adc6c92in 1 report
- hxxp://23.240.77[.]233:8085/pM.jsin 1 report
- hxxp://47.18.167[.]159:8085/pM.jsin 1 report
Copy these 14 indicators · defanged
Also named with it: CVE-2024-47575, CVE-2025-61624, CVE-2024-26009, CVE-2024-26008, CVE-2025-59718, CVE-2025-59719
Thanks — we review every report.