Two distinct but convergent threat streams surfaced in this OTX collection cycle, and together they sketch the modern intrusion economy: state-aligned operators hollowing out network edge infrastructure while criminal syndicates industrialize credential theft at global scale.

Stream 1 — CL-STA-0954 / PEERSTITCH: A multi-stage intrusion against a telecommunications organization exploited CVE-2024-47575 (FortiManager authentication bypass) to exfiltrate configurations and cryptographic material for over 500 managed FortiGate firewalls. The actor then leveraged CVE-2025-61624 to deploy PEERSTITCH, a novel memory-resident ARM64 implant that leaves no disk artifacts — a deliberate architecture choice that defeats traditional file-based EDR and forensic acquisition. Related CVEs in the indicator set (CVE-2024-26009, CVE-2025-59718, CVE-2025-59719) suggest the actor maintains a full exploit ladder across the Fortinet product line, enabling re-entry as patches close individual holes. The objective is clear: persistent, stealthy control of the management plane that governs an organization's entire firewall fleet — effectively owning the network's security enforcement layer.

Stream 2 — Iron Man System / YamStore PhaaS: Resecurity's mapping of the Iron Man System exposes a commercial Phishing-as-a-Service platform sold to criminal buyers as a self-hosted package with a licensing backend. Pre-built lure pages impersonate postal services, banks, government agencies, healthcare, transportation, and retail brands. Infrastructure analysis reveals Chinese-language operator communities, Docker-based deployment (docker.aidchildren.cc), and API-driven kit management (api2.* subdomains). The licensing backend indicates a mature criminal business model: buyers get templates, hosting automation, and update channels — while operators retain kill-switch control through license validation.

The collective signal: edge device compromise (Stream 1) yields the network footholds and valid credentials that feed downstream fraud ecosystems (Stream 2). Defenders must treat Fortinet appliance integrity and phishing-resilient identity as a single, linked defense problem.

Threat Actor / Malware Profile

CL-STA-0954 — PEERSTITCH Implant

Attribution: Activity cluster tracked as CL-STA-0954, assessed to be a state-nexus espionage actor targeting telecommunications infrastructure. TTP overlap with prior Fortinet-focused campaigns suggests a disciplined, resourced operation with exploit development capability.

Distribution / Initial Access: Exploitation of internet-exposed FortiManager appliances via CVE-2024-47575 (missing authentication on critical function), followed by CVE-2025-61624 to execute the implant payload on FortiGate devices.

Payload Behavior: PEERSTITCH is a 64-bit ARM implant compiled for FortiGate's ARM architecture. It operates entirely in memory — no files written to the FortiGate filesystem. Capabilities include configuration theft, cryptographic material exfiltration, and command execution on the managed fleet.

C2 Communication: Implant communicates with actor-controlled infrastructure including 23.240.77.233 and 47.18.167.159 (US-based residential/hosting IPs, consistent with relay or compromised-node infrastructure). Traffic blends with legitimate FortiManager-to-FortiGate management flows (FGFM protocol), making egress filtering on management VLANs critical.

Persistence: Memory-resident design means persistence is achieved via exploit re-entry and manipulation of FortiManager's trusted relationship with managed devices rather than traditional autoruns. Survives signature scans; defeated only by reboot plus patch.

Anti-Analysis: No disk artifacts, ARM64 compilation (evades x86 sandbox detonation), abuse of legitimate FGFM management channel, and staged exploitation that separates initial access from payload delivery.

Iron Man System — PhaaS Platform

Distribution: Sold in Chinese-language criminal communities as a licensed, self-hosted package. Buyers deploy via Docker containers on bulletproof or compromised hosting.

Payload Behavior: Pre-built lure kits impersonating postal carriers (package redelivery scams), banks (credential harvesting), government portals, healthcare and transportation brands. Harvested credentials flow to buyer-controlled panels via the api2.* backend endpoints.

C2 / Backend: api2.haoyutai.cc, api2.peaceman.cc, bin2.peaceman.cc serve as kit management and data exfiltration APIs. protonmail.me abuse indicates operator contact points; loveboy.xyz and haoeryu.top function as lure/redirect infrastructure.

Persistence: Not endpoint-persistent — persistence lives in the criminal supply chain: the licensing backend ensures kits stay updated and lure pages rotate domains faster than takedowns.

Anti-Analysis: License-gated deployment prevents researcher sandbox detonation without purchasing access; Docker encapsulation hides kit internals; rapid domain churn.

IOC Analysis

Indicator types in this collection:

Tooling to decode/operationalize:

• OTX DirectConnect / API — pull full pulse JSON for all 17+13 indicators and push to SIEM via STIX/TAXII
• MISP — import pulses for correlation against internal telemetry
• FortiGate FortiView + FortiAnalyzer — hunt FGFM anomalies and unauthorized admin sessions
• DNS logging (e.g., Infoblox, Windows DNS debug, Zeek dns.log) — retro-hunt PhaaS domain resolution over 90 days
• urlscan.io / VirusTotal — pivot on PhaaS domains to discover newly spawned lure infrastructure sharing kit fingerprints

Detection Engineering

---
title: FortiManager/FortiGate Exploitation and Unauthorized Management Session (CL-STA-0954 / PEERSTITCH)
id: 8f2a1b3c-4d5e-4f6a-9b7c-1a2b3c4d5e6f
status: experimental
description: Detects suspicious authentication and configuration access patterns on FortiManager/FortiGate appliances consistent with CVE-2024-47575 and CVE-2025-61624 exploitation leading to PEERSTITCH deployment.
author: Security Arsenal Threat Intelligence
date: 2026/10/15
references:
  - https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
logsource:
  product: fortigate
  service: event
detection:
  selection_auth:
    logid:
      - '0100032001'
      - '0100044546'
    msg|contains:
      - 'login'
      - 'authenticate'
  selection_config:
    msg|contains:
      - 'config'
      - 'backup'
      - 'download'
      - 'export'
  filter_known_admins:
    srcip|cidr:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
  condition: (selection_auth or selection_config) and not filter_known_admins
falsepositives:
  - Legitimate remote administration from untracked networks
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.credential_access
  - attack.t1552
---
title: Egress Connection to PEERSTITCH C2 Infrastructure
id: 9e3b2c4d-5e6f-4a7b-8c9d-2b3c4d5e6f7a
status: experimental
description: Detects network connections from internal assets to known PEERSTITCH command-and-control IP addresses identified in OTX pulse data.
author: Security Arsenal Threat Intelligence
date: 2026/10/15
references:
  - https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
logsource:
  category: network_connection
detection:
  selection_c2:
    DestinationIp:
      - '23.240.77.233'
      - '47.18.167.159'
  condition: selection_c2
falsepositives:
  - None expected; these IPs are confirmed actor infrastructure
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
---
title: Iron Man PhaaS Infrastructure DNS Resolution
id: 7d1a0b2c-3c4d-4e5f-8a9b-0a1b2c3d4e5f
status: experimental
description: Detects DNS resolution of domains associated with the Iron Man System Phishing-as-a-Service kit management and lure infrastructure.
author: Security Arsenal Threat Intelligence
date: 2026/10/15
references:
  - https://www.resecurity.com/blog/article/iron-man-yamstore-powering-a-global-phishing-as-a-service-ecosystem
logsource:
  category: dns
detection:
  selection:
    query:
      - 'loveboy.xyz'
      - 'docker.aidchildren.cc'
      - 'aidchildren.cc'
      - 'haoeryu.top'
      - 'api2.haoyutai.cc'
      - 'api2.peaceman.cc'
      - 'bin2.peaceman.cc'
  condition: selection
falsepositives:
  - Threat research activity from SOC assets
level: high
tags:
  - attack.phishing
  - attack.t1566
  - attack.command_and_control

// Sentinel Hunt: PEERSTITCH C2 contact + Iron Man PhaaS DNS resolution + FortiGate-adjacent process anomalies
let peerstitchC2 = dynamic(["23.240.77.233", "47.18.167.159"]);
let phaasDomains = dynamic(["loveboy.xyz", "aidchildren.cc", "haoeryu.top", "api2.haoyutai.cc", "api2.peaceman.cc", "bin2.peaceman.cc", "docker.aidchildren.cc"]);
let networkHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (peerstitchC2) or RemoteUrl has_any (phaasDomains)
| project HitType="Network-C2-PhaaS", TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort;
let dnsHits = DeviceEvents
| where TimeGenerated > ago(30d)
| where ActionType == "DnsQueryResponse"
| extend ParsedQuery = tostring(parse_json(AdditionalFields).DnsQueryString)
| where ParsedQuery has_any (phaasDomains)
| project HitType="DNS-PhaaS", TimeGenerated, DeviceName, ParsedQuery, InitiatingProcessFileName;
let procAnomalies = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName has_any ("fmgd", "fgfm", "sslvpnd", "cu_acd")  // FortiOS daemon names observed via mounted/managed contexts
   or ProcessCommandLine has_any ("fortimanager", "fgfm", "diagnose sniffer")
| project HitType="Process-FortiOS-Anomaly", TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName;
union networkHits, dnsHits, procAnomalies
| order by TimeGenerated desc

# PEERSTITCH + Iron Man PhaaS IOC Hunt — Security Arsenal
# Run elevated on endpoints; checks network artifacts, DNS cache, and known hash
param([switch]$Deep)

$report = @()

Write-Host "[*] PEERSTITCH / Iron Man PhaaS IOC Hunt - $(Get-Date)" -ForegroundColor Cyan

# --- 1. Active & historical network connections to PEERSTITCH C2 ---
$c2IPs = @("23.240.77.233","47.18.167.159")
Write-Host "[*] Checking active connections to PEERSTITCH C2..." -ForegroundColor Yellow
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $c2IPs -contains $_.RemoteAddress }
if ($conns) {
    foreach ($c in $conns) {
        $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
        $report += "[CRITICAL] Active C2 connection: $($c.RemoteAddress):$($c.RemotePort) via $($proc.ProcessName) (PID $($c.OwningProcess))"
    }
} else { Write-Host "    No active C2 connections." -ForegroundColor Green }

# --- 2. DNS client cache for PhaaS domains ---
$phaas = @("loveboy.xyz","protonmail.me","aidchildren.cc","haoeryu.top","api2.haoyutai.cc","api2.peaceman.cc","bin2.peaceman.cc")
Write-Host "[*] Checking DNS cache for Iron Man PhaaS domains..." -ForegroundColor Yellow
$cache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $phaas) {
    $hits = $cache | Where-Object { $_.Entry -like "*$d*" }
    if ($hits) { $report += "[HIGH] DNS cache hit for PhaaS domain: $d" }
}

# --- 3. Search filesystem for PEERSTITCH SHA256 (forensic completeness) ---
if ($Deep) {
    Write-Host "[*] Deep mode: hashing recent executables in temp/user dirs..." -ForegroundColor Yellow
    $targetHash = "8D969EEF6ECAD3C29A3A629280E686CF0C3F5D5A86AFF3CA12020C923ADC6C92"
    $paths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","C:\ProgramData")
    foreach ($p in $paths) {
        Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.Length -lt 20MB } | ForEach-Object {
            try {
                $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash
                if ($h -eq $targetHash) { $report += "[CRITICAL] PEERSTITCH hash match: $($_.FullName)" }
            } catch {}
        }
    }
}

# --- 4. Proxy/firewall log hint: check hosts file tampering ---
Write-Host "[*] Checking hosts file for suspicious redirects..." -ForegroundColor Yellow
$hosts = Get-Content "$env:SystemRoot\System32\drivers\etc\hosts" -ErrorAction SilentlyContinue
foreach ($line in $hosts) {
    foreach ($d in $phaas) { if ($line -like "*$d*") { $report += "[MEDIUM] Hosts file entry references PhaaS domain: $line" } }
}

# --- Report ---
Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Cyan
if ($report.Count -eq 0) { Write-Host "No indicators found." -ForegroundColor Green }
else { $report | ForEach-Object { Write-Host $_ -ForegroundColor Red }; $report | Out-File "$env:USERPROFILE\Desktop\ioc_hunt_$(Get-Date -Format yyyyMMdd_HHmm).txt" }
Write-Host "[*] Hunt complete." -ForegroundColor Cyan

Response Priorities

Immediate (0-4 hours):

• Block PEERSTITCH C2 IPs (23.240.77.233, 47.18.167.159) at all egress points; sinkhole all Iron Man PhaaS domains in DNS and web proxy
• Inventory every FortiManager/FortiGate appliance; confirm patch state against CVE-2024-47575 and CVE-2025-61624 — any unpatched, internet-exposed FortiManager is an assumed breach
• Remove FortiManager from direct internet exposure immediately; restrict FGFM/admin interfaces to management VLAN ACLs
• Run the PowerShell hunt across endpoints; query 90 days of DNS/firewall logs for the listed domains and IPs

24 hours:

• Given exfiltration of cryptographic material and configurations for 500+ FortiGates in the reference campaign: rotate ALL credentials, pre-shared keys, certificates, VPN secrets, and admin passwords managed through FortiManager — treat cryptographic material as compromised
• Review FortiManager admin session logs for unauthorized logins and configuration export events (the Sigma rule above operationalizes this)
• Force credential resets and phishing-resistant MFA re-enrollment for any user whose device resolved a PhaaS domain — Iron Man kits harvest banking and government portal credentials
• Reboot patched FortiGate devices to clear any memory-resident implant; validate firmware integrity via Fortinet's published verification procedures

1 week:

• Architecturally isolate the security management plane: dedicated out-of-band management network, jump-host-only access, no inbound internet reachability for FortiManager
• Deploy egress filtering on firewall management subnets — FortiGate/FortiManager devices should only reach FortiGuard and approved update servers, never arbitrary internet IPs
• Enroll in Fortinet PSIRT advisories and OTX pulse subscriptions for the Fortinet CVE cluster; build detection-as-code pipelines that auto-ingest new indicators
• Roll out phishing-resistant authentication (FIDO2/passkeys) for finance, government, and administrative portals; supplement with brand-monitoring takedown workflows since Iron Man kits rotate lure domains rapidly
• Conduct tabletop exercise on "management plane compromise" scenario — the PEERSTITCH campaign proves edge management infrastructure is now a tier-one target

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub