Attackers Deploy Memory-Resident PEERSTITCH Malware on FortiGate

🚨 ACTIVE EXPLOITATION

• Unit 42: Attackers Deploy Memory-Resident PEERSTITCH Malware on FortiGate Firewalls After FortiManager Breach
  Unit 42 reports attackers exploited Fortinet vulnerabilities to steal data from 500+ FortiGate firewalls and deploy the stealthy PEERSTITCH implant.
  • Affects Fortinet FortiManager and FortiGate firewalls, including a telecom managed service provider whose 500+ managed FortiGate devices' configurations and credentials were exposed.
  • Attackers (tracked as CL-STA-0954/UNC5820) exploited CVE-2024-47575 (FortiJump) on FortiManager via the FMG-Access TCP 541 management channel, registering a rogue Virtual FortiGate and exfiltrating an archive with configs, credentials, certificates and device inventories.
  • They pushed unauthorized packet-capture rules to managed firewalls targeting HTTP, TFTP, RADIUS and LDAP traffic, then used recovered credentials to open unauthorized SSL/VPN sessions into internal network-management segments.
  • They exploited CVE-2025-61624, a FortiOS auto-script path traversal, to deploy PEERSTITCH, a memory-resident ARM64 implant injected into the miglogd and iked processes that leaves no disk binary, opens no ports and makes no outbound connections.
  • A second control channel abused Apache mod_md with Node.js for reverse shells; attackers cleared logs, removed rogue accounts and deleted the lldprx injector to hinder investigation. IOCs include SHA-256 b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70 (PEERSTITCH ARM64 injector).
  Sources 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

💥 BREACHES & INCIDENTS

• French Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers
  A cyberattack forced refrigerators to heat up at roughly 700 French supermarkets, and France's ANSSI says Copeland and Dixell controllers were also affected.

  • About 700 French supermarkets were hit, including chains Carrefour, Coopérative U, E.Leclerc, Intermarché and Monoprix; stores in Spain, Portugal, Poland, Germany and Belgium were also affected.
  • Attackers overrode refrigeration controllers, heating fridges to 50°C for hours, lengthening defrost cycles from one to as many as eight hours, spoiling food worth millions of euros and causing fires.
  • CERT-FR first warned of compromises of Danfoss AK-SM and AK-SC controllers, then added Copeland XWEB and Dixell XWEB systems; most affected devices were end-of-life AK-SM 800 and AK-SC 355 models, plus some AK-SM 800A units on outdated firmware.
  • Censys counted nearly 3,000 internet-exposed Danfoss StoreView control panels before the attack, over 1,800 in France; no group has claimed responsibility and no ransom demand has been made.
  • Copeland has acknowledged a vulnerability after initially declining to confirm ANSSI's findings; Claroty previously disclosed 23 flaws in XWEB Pro and flaws in AK-SM 800A, though the attack has not been tied to them.
  Sources 📄 Source: afp.com · 📎 Coverage: securityweek.com · 👁 via SecurityWeek

• Cartoon Network 'Classic CN Gigaleak' reportedly exposes 200GB of internal animation files
  A reported Cartoon Network gigaleak has exposed over 200GB of internal animation production files, though its size, source, and authenticity remain unverified.

  • Affects Cartoon Network/Warner Bros. production material for shows including The Amazing World of Gumball, Adventure Time, Regular Show, The Powerpuff Girls, Dexter's Laboratory, Johnny Bravo, Foster's Home for Imaginary Friends, and Ed, Edd n Eddy
  • Leaked files reportedly include Flash projects, editable character rigs, layered Photoshop documents, model sheets, storyboards, animatics, and production guides; Adventure Time material is said to total around 90GB
  • Reports spread across online communities around October 9-10, with fans naming the collection the 'Classic CN Gigaleak' and some posts claiming a wider archive approaching 1TB
  • Files were shared via a Google Drive collection linked to an anonymous X account called 'totallynotaburner'; no confirmed attack method, stolen account, or software flaw has been identified
  • Some download links were removed following copyright complaints, and the archive's full volume and origin have not been independently verified
  Sources 📄 Source: indiatimes.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

🕵️ RESEARCH & DEEP DIVES

• UPDATE: Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
  Next.js has released an out-of-band update fixing two critical unauthenticated RCE flaws and a high-severity denial-of-service flaw.

  • Applies to Next.js App Router apps: Cache Components users (16.0.0–16.4.0), apps passing attacker-supplied SVGs to sharp on glibc-based Linux (10.0.0–15.5.27, 16.0.0–16.4.0), and apps with Server Actions (13.0.0–15.5.27, 16.0.0–16.4.0).
  • Two RCE flaws score CVSS 9.5: one via a use cache function returning multiple typed arrays (GHSA-673q-mjm6-r5xr), the other a librsvg memory bug (CVE-2026-96889) reached through the sharp package; a DoS flaw (GHSA-p3m5-59mp-jv5r) lets crafted requests pin a server process at full CPU.
  • The RSC flaw affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0.0–19.3.0, but is far narrower than December 2025's React2Shell and unrelated to it.
  • Fixes ship in Next.js 16.4.1 and 15.5.28; the image flaw additionally requires sharp 0.35.5 or later, and 15.5.28 may still leave vulnerable sharp 0.34.x installed.
  • As of October 15, 2026, no public reports of exploitation exist, and the use cache and Server Actions flaws lack CVEs, so npm audit-based scanners may not flag them.
  Sources 📄 Source: nextjs.org · 📎 Coverage: thehackernews.com · 👁 via The Hacker News, Cyber Security News

• Citizen Lab: governments deliver zero-click spyware via malicious online ads
  Citizen Lab documented the first confirmed zero-click spyware infections delivered through targeted online ads.

  • Affects anyone reachable by online ad networks; confirmed victims include at least 45 Windows computers at Al Jazeera, hacked in 2024-2025
  • Israeli firm Discover-Tech's Controlium ad platform served as a bridge between ad vendors and mercenary spyware makers Candiru (now Integrity Labs) and Bindecy
  • Malicious ads contain code that contacts a Discover-Tech server, which checks if the visitor matches a target and returns JavaScript that silently infects the device — no click needed
  • Researchers recreated Controlium's dashboard from exposed source code and found billions of exposed ad bidding records showing ads on devices of militaries, governments, and critical infrastructure
  • Potentially malicious ads were also seen on networks of the IAEA and International Criminal Court; researchers say Discover-Tech is 'just the tip of the iceberg'
  Sources 📄 Source: gettyimages.com · 📎 Coverage: techcrunch.com · 👁 via @zackwhittaker@mastodon.social, cryptika.com (discovered)

• Iron Man phishing kit tied to 1B messages targeting 75,000 organizations; Microsoft disrupts network
  Microsoft and Resecurity disrupted a Chinese-language phishing-as-a-service ecosystem whose Iron Man System kit enabled over one billion phishing messages against 75,000 organizations.

  • Targets organizations in healthcare, financial services, wholesale distribution, and IT sectors across Japan, the US, Australia, and India, with 2,360 phishing templates covering 130 countries
  • Iron Man System is a Go-based PhaaS kit sold via the YAM Store marketplace (Storm-3119) alongside CoGUI and Haozi kits (tracked as Storm-2990), paid for in USDT and Ethereum
  • Kit is delivered as a self-hosted container image with a bilingual Chinese-English admin panel (version 6.3.1 tested), impersonating couriers, banks, tax agencies, telecoms, and government bodies; DHL, DPD, and Apple had the most templates
  • Resecurity bought a license and ran the kit in a lab, tracing a licensing backend (api2[.]peaceman[.]cc), telemetry host (log2[.]peaceloving[.]xyz), and a self-hosted Gitea registry (docker[.]aidchildren[.]cc) exposing 911 builds and 8 operator accounts
  • YAM Store brokers compromised or fraudulent Microsoft 365 and Azure for Education tenants so buyers can send phishing from seemingly legitimate infrastructure
  Sources 📎 Coverage: resecurity.com · 👁 via Cyber Security News, cryptika.com (discovered)

• Help TDS linked to Russian affiliate program Hotejka; 20,000+ Cloudflare Pages domains host tech support scams
  Infoblox links the Help TDS traffic distribution system to the Hotejka affiliate program, a suspected rebrand of ROI777, which has spun up over 20,000 Cloudflare Pages domains to run tech support scams.

  • Help TDS, active since at least April 2017, is operated by Hotejka, a small Russian-language affiliate program believed to be a rebrand of ROI777 (exposed in 2018's Operation Prowli).
  • The TDS redirects victims to tech support scams using fake Microsoft Windows security alerts and browser locks that push users to call scam support numbers.
  • Call-center operators socially engineer victims into installing remote desktop tools like UltraViewer, giving attackers persistent remote access for living-off-the-land malware operations.
  • Traffic arrives via ~20 affiliates including Balada Injector, Detour Dog, and DollyWay, often through compromised WordPress sites; a malicious plugin 'woocommerce_inputs' has been used to steal WordPress credentials.
  • Since April 2026, scams run on free Cloudflare Pages sites (*.pages[.]dev), with roughly 300 disposable pages created per day and over 20,000 domains detected; the TDS is believed to be built on Keitaro.
    📄 <https://www.infoblox.com/blog/threat-intelligence/inside-help-tds-hotejka-cloudflare-pages-and-predictive