PEERSTITCH malware exploited FortiManager to expose 500+ firewalls, evade detection inside FortiOS memory, and maintain stealthy access. PEERSTITCH, a stealthy implant deployed during a prolonged intrusion, helped attackers maintain access to a telecom managed service provider after compromising its FortiManager appliance. Palo Alto Networks Unit 42 documented the operation, which began in September 2024 and exposed credentials and configurations for more than 500 downstream firewalls. “Unit 42 investigated a multi-stage network intrusion against a telecommunications organization that occurred in September 2024, which we are tracking as cluster CL-STA-0954 (aka UNC5820). The attackers behind CL-STA-0954 achieved an initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance.” reads the report published by Palo Alto Networks. “From that single appliance, our observations are that the attackers exfiltrated an archive containing running configurations, cryptographic material and database files containing information about more than 500 managed FortiGate firewalls. Those firewalls protected the target’s own infrastructure and the networks of its clients.” The initial access relied on CVE-2024-47575, known as FortiJump, which allowed an unauthenticated attacker to register a rogue virtual device with the central management platform over TCP port 541. Within minutes, the attackers extracted a configuration archive containing serial numbers, public IP addresses, routing tables, VPN credentials, and cryptographic trust material for every managed firewall. One compromised management system had effectively handed them the keys to hundreds of networks. The targeted 500 devices didn’t all belong to the same organization. They protected the managed service provider’s infrastructure and its clients’ networks. The attackers got running configurations and private keys for firewalls belonging to organizations that had no idea any of this was happening. Unit 42 was clear about the scope: the investigation covered only the provider’s own environment, not the downstream clients. Armed with decrypted credentials from the stolen configuration files, which stored passwords as reversible ciphertext, the attackers then established unauthorized SSL/VPN sessions into internal network management segments from external staging addresses. That’s the moment reconnaissance turned into active access. In the second stage, attackers exploited CVE-2025-61624, a path traversal flaw in the FortiOS auto-script engine, to deploy a new implant called PEERSTITCH. The implant is a 64-bit ARM64 binary written in C, but what it does is unusual. Unit 42’s researchers put it plainly: “PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections. Instead, it communicates through traffic generated by legitimate processes on the infected host, which makes the malware resistant to conventional endpoint and network detection.” the report continues. “The attackers also impersonated the FortiManager platform to pull from managed firewalls of other hosts in the targeted network.” Instead, it injects itself into two legitimate FortiOS daemons, the logging process and the VPN service, and creates a covert communication bridge between them using memory that’s already allocated to those running processes. When traffic passing through the logging daemon matches two specific markers, a port number embedded in data and a link-local IP address, it extracts a session token and writes it directly into the VPN daemon’s memory using Linux’s /proc filesystem. When the VPN daemon processes a subsequent session carrying that same tag, it takes an alternate execution path, bypassing FortiOS security checks entirely. PEERSTITCH is hard to detect because it leaves no persistent file on disk, opens no listening ports, and initiates no outbound network connections. The only way to detect it is by inspecting live process memory for anomalous read-write-execute (RWX) regions in the two targeted daemons or identifying NOP patches at specific offsets in their code. Fortinet’s Integrity Checker Tool cannot detect the implant because it scans files on disk, which remain untouched. The attackers also established a secondary command channel by abusing Apache’s built-in certificate management module on the firewalls. They embedded shell commands in the domain name field of certificate validation requests and configured Apache to retry them continuously, creating a persistent outbound reverse shell through a legitimate system process. Before running their malicious auto-scripts, the attackers killed the logging and syslog daemons to suppress any trace of what was about to happen. Crash logs were wiped. Rogue administrator accounts and script objects were automatically deleted shortly after execution. The malicious ACME configuration file was overwritten with innocent-looking text. The PEERSTITCH injector unlinked its own binary from disk after completing execution. “The cryptographic trust material governing the platform’s relationship with every managed device leaves with the attacker and remains valid until it is rotated. Defenders must treat edge management interfaces with the highest level of zero trust isolation.” Palo Alto Networks states. “They must also treat the credentials and certificates those interfaces hold as compromised the moment the platform is.” Patching FortiManager doesn’t reverse the data theft. The stolen cryptographic keys remain valid until the trust material on every managed device is individually rotated. A firmware update alone won’t invalidate them. The broader lesson goes beyond Fortinet: management platforms are high-value targets because compromising one can expose an entire network. As Unit 42 noted, “the management platform is the highest-value target on the network.” When that platform belongs to a managed service provider, a single breach can affect hundreds of downstream customers, turning a local compromise into a supply-chain security incident. “For organizations that manage infrastructure on behalf of others, the management platform is the highest-value target on the network. Compromising the management platform is not contained by the boundary of the organization that owns it.” the report concludes. “That compromise also does not end when the platform is patched.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, PEERSTITCH malware)
Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. Smart App Control is a Windows 11 security feature that uses Microsoft's app intelligence services and code integrity features and works alongside Microsoft Defender and SmartScreen to block potentially harmful apps or binaries. According to the company, on affected devices running Windows 11, version 24H2 and later, the Smart App Control option is grayed out and cannot be toggled. "After installing this update, some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off. On affected devices, the option to turn on Smart App Control might be grayed out," Microsoft said in an update to the KB5127648 advisory.
The Administrative Office of the US Courts says a cyberattack on government contractor BAE Systems has taken down the notice system used by federal bankruptcy courts. In a Thursday press release, the Administrative Office of the US Courts said the BAE Systems cyberattack also halted the production and distribution of bankruptcy notices. "The Administrative Office of the US Courts has been in communication with the impacted courts and is also coordinating with BAE Systems. BAE is actively investigating this incident and working to restore operations," it said. "As a result of the incident, all access to the BNC systems and websites that BAE operates on behalf of the Judiciary and the related bankruptcy noticing process are unavailable at this time, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service."
The regulated utility company CenterPoint Energy says a data breach exposed the personal information of more than 1 million people in Texas. CenterPoint Energy is a regulated utility company used to deliver natural gas and electricity infrastructure, maintain power grids and pipelines, and restore service across parts of Texas, Indiana, Ohio, and Minnesota. The organization disclosed a data breach affecting more than 1 million people in Texas. This week, CenterPoint Energy told the Texas Attorney General’s Office that the breach affected 1,062,060 Texas residents. The company does not appear to have notified the affected individuals by letter. “More than one million Texans were affected by a CenterPoint Energy data breach that compromised sensitive personal information, according to newly published information from the Texas Attorney General’s Office.” reported the broadcast Click2Huston. “The state’s data breach database lists 1,062,060 Texans as being affected. The information involved includes customers’ names, addresses, Social Security information and driver’s-license numbers.” Days before the first disclosure, on September 12, a threat actor using the alias “4d722e4d656f77” claimed on a cybercrime forum to have extracted roughly 7.49 million customer records from CenterPoint Energy. “In September 2026, CenterPoint Energy, Inc. (the “Company”) became aware of an online post by a third party claiming to have obtained a data set containing certain of the Company’s customer information.” reads the FORM 8-K report filed with SEC.”While the investigation remains ongoing, the Company has determined that an unauthorized third party obtained personal information relating to a portion of the Company’s customers through one of the Company’s external facing systems (the “Incident”).” The hacker claimed the theft of names, phone numbers, service and billing addresses, account numbers, billing amounts, payment status, and partial Social Security numbers. He offered a 2.5 GB archive for download. The attacker warned that “next time we won’t simply pull data, we’ll start attacking the main infrastructure,” a line that reads well on a forum but should still be taken seriously by any critical infrastructure operator. The attackers claimed they stole over the records through an API they say lacked proper WAF protection, rate limiting, and authentication. They also claimed the company tried to stop the data dump only after millions of records had been extracted. “CenterPoint Energy continues to actively investigate the cybersecurity incident disclosed last month. Upon learning of the issue, CenterPoint activated our incident response procedures and engaged external cybersecurity, forensic, and legal advisors to assist with the investigation.” a spokesperson for CenterPoint said on Wednesday. “We continue to work with third-party experts to assess the scope of affected customer data to identify which customers will be provided notifications in accordance with applicable legal requirements.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, data breach)
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. Remote Support is the company's enterprise-grade support solution that helps IT service desks, help desks, and customer support teams troubleshoot issues remotely. Tracked as CVE-2026-102764, this actively exploited authentication bypass vulnerability lets unprivileged remote attackers perform file operations on unpatched appliances and affects RS 26.2.3 or earlier. BeyondTrust patched the security issue for all Remote Support and Privileged Remote Access SaaS customers on October 8, but self-hosted installations must be patched manually if automatic updates are not enabled. While the company shared limited details about the vulnerability, it said the zero-day was abused in the wild by a suspected China-nexus espionage actor tracked by Mandiant and Google Threat Intelligence Group (GTIG) security researchers as "Armory Castle" (formerly UNC5221) and by cybersecurity firm CrowdStrike as "Warp Panda."
Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft. The post AI-Powered Espionage Campaign Targets Government Linux Infrastructure appeared first on Unit 42.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability Cisco confirmed this week that threat actors are exploiting a critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76519 (CVSS score of 9.8). An attacker can exploit the flaw by sending a crafted email attachment through the gateway and, if it lands right, writing arbitrary files to the underlying operating system. The flaw CVE-2026-0322 (CVSS score: 8.6) is a high-severity code injection vulnerability in the management interface of Palo Alto Networks PAN-OS. It could allow an authenticated attacker with network access and high-level privileges to execute arbitrary code with root privileges on an affected firewall. The vulnerability affects PA-Series and VM-Series firewalls and Panorama appliances. Palo Alto Networks confirmed that limited exploitation has been observed targeting the management interface. The company recommends restricting access to trusted internal IP addresses and installing the relevant security updates. The flaw CVE-2026-105133 (CVSS score: 5.5) is an improper authentication vulnerability in AhsayCBS, a backup management platform. The flaw affects the checkSysPwd function in the product’s API and could allow a remote attacker to bypass authentication by manipulating the random parameter. Starting on October 7, 2026, attackers used it to bypass authentication before exploiting a second vulnerability, CVE-2026-105134, to execute commands on affected servers. Huntress reported that at least five organizations had been targeted by October 8. The flaw CVE-2026-105134 (CVSS score: 9.3) is a critical operating system command injection vulnerability in the Replication Receiver component of AhsayCBS. The flaw affects the /rps/api/json/UpdateReceivers.do endpoint and could allow an unauthenticated remote attacker to execute arbitrary commands on the underlying system. The vulnerability is being actively exploited in the wild. Attackers have chained it with CVE-2026-105133 to gain remote code execution with NT AUTHORITY\SYSTEM privileges, deploy JSP web shells and install XMRig cryptocurrency miners disguised as Microsoft Edge processes. Huntress observed attacks against at least five organizations by October 8, 2026. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaws by October 17, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Silent Lynx, a group likely based in Kazakhstan, targets Russian energy and government entities in espionage campaigns across Central Asia. Researchers from Cisco Talos and Recorded Future published a detailed paper on a threat actor they call Silent Lynx (aka UAT-6275, TAG-193), a Kazakhstan nexus group conducting espionage across Central Asia. The targets include the Orsk Oil Refinery in southern Russia, about 25 kilometers from the Kazakhstan border, and the government of Nizhny Novgorod, a major city about 425 kilometers east of Moscow. The city lies where the Volga and Oka rivers meet, an important waterway system connected to the Caspian Sea. This target may be significant because Kazakhstan depends on the Caspian basin. The group has been running targeted intrusion campaigns against government bodies, diplomatic missions and civil society organizations across Central Asia since at least 2024. “Silent Lynx (overlapping with activity tracked as UAT-6275 by Cisco Talos and as TAG-193 by Recorded Future) is a persistent threat actor that has conducted targeted intrusion campaigns against government ministries, diplomatic missions and civil society organizations across Central Asia since at least 2024.” the paper states. “The group maintains a strong focus on high-value public sector organizations in the Commonwealth of Independent States (CIS), frequently leveraging spear-phishing campaigns conducted through compromised government email accounts and malware staging through trusted public services such as GitHub to increase credibility and infection success rates.” The group overlaps significantly with clusters previously documented under names like YoroTrooper, ShadowSilk, and Hydra Saiga, all pointing at the same underlying activity. The toolkit is deliberately lightweight: PowerShell-based reverse shells, proprietary shells written in C++, C#, and Go, commodity tunneling tools, and spear phishing emails sent through compromised government email accounts in Tajikistan and Kyrgyzstan to add credibility. GitHub, Telegram, and hijacked legitimate servers all serve as staging platforms. Nothing about it is technically flashy, which is part of why the group has stayed active for years without much public attention. The researchers found links that go beyond technical evidence. In March 2026, a Tajik government agency contacted a Silent Lynx server, shortly after Kazakhstan’s lower house of parliament ratified a Treaty on Allied Relations with Tajikistan. In early April, a Belarusian government entity appeared on the same infrastructure, about a week before Kazakhstan’s president met with the Belarusian foreign minister in Astana. These links do not prove the reasons behind the activity, but the researchers highlight them in their paper, and they are difficult to ignore. The connection to the Orsk refinery also has a clear context. A Ukrainian drone attack in August forced the refinery to shut down for months. Russia had already asked Kazakhstan to help make up for the resulting loss of refining capacity. If a Kazakhstan-linked actor was collecting intelligence on Russian energy infrastructure at that time, it could have been assessing the economic impact or trying to understand how the disruption might affect Kazakhstan’s own export pipelines. The researchers stress that they do not have enough evidence to identify a specific motive. However, they present the facts and let readers draw their own conclusions. “A sample compiled in August 2025 was observed using a document titled Деловое предложение о сотрудничестве между ГК «Туркменнебит» и руководством Орского НПЗ (translated: Business proposal on cooperation between State Concern ‘Turkmennebit’ and the management of Orsk Refinery) (see Figure 11). We assess that this sample may be targeting Russia’s critical energy infrastructure, given the close integration of the Russian BREAK THE SILENCE: TRACKING SILENT LYNX THROUGH EXPOSED INFRASTRUCTURE SHEN & VÖGELE 10 VIRUS BULLETIN CONFERENCE OCTOBER 2026 and Kazakh energy sectors.” continues the report. “The document outlines proposals for developing mutually beneficial cooperation, with a particular focus on the exchange of expertise, technologies, and industry best practices. It is worth noting that the author of this PDF file is ‘pickle rick’ and the document was created just one hour after the payload was compiled. The name ‘pickle’ is aligned with the name ‘pickl’ we observed in the PickleShell PDB string3.” What gave the group away wasn’t a sophisticated interception, it was their own operational sloppiness. They left open directories exposed on public servers containing live tooling, staged payloads, and one very incriminating shell command history showing keyboard input typed in Latin with a Russian keyboard layout active, so “whoami” came out as “црщфьш.” GitHub commit timestamps across 77 commits fit working hours in Astana, Kazakhstan, at 95 percent, compared to only 51 percent if you plot them against Moscow time. Administration connections to Silent Lynx servers came from ProtonVPN egress IPs geolocated to Kazakhstan, exclusively on weekdays between 7 AM and noon local time. The group’s servers were also being reached from those VPN addresses, which Proton typically assigns based on geographic proximity. Two malware samples were uploaded to VirusTotal from Kazakhstan within minutes of compilation, which is classic anti-detection testing behavior and points to the operator location directly. “We identified several additional indicators that strengthen the assessment of a Kazakhstan-based origin. The first derives from what appears to be malware detection-testing activity conducted through VirusTotal.” continues the report. “Two samples showed this pattern: an early Chvost sample12 was uploaded to VirusTotal only 86 seconds after compilation, while a second sample13 was uploaded approximately four minutes after compilation. Both samples were uploaded from Kazakhstan, and the same uploaders had submitted additional tools that were later observed in Silent Lynx campaigns.” A researcher at Johns Hopkins School of Advanced International Studies told Reuters that the case highlights an important point: cyber espionage is no longer the domain of a few major powers. Smaller countries are also developing their capabilities and running long-term operations against neighboring states, often driven by serious geopolitical interests. Silent Lynx is also becoming more technically advanced. In April 2026, the group used an exploit for the first time to deliver malware. It abused a WinRAR path traversal flaw (CVE-2025-8088) to place malicious files directly in the Windows Startup folder, without requiring victims to enable macros. The group also stored a public proof of concept for a FortiWeb authentication bypass vulnerability on its own command-and-control (C2) server. Researchers have also found signs of growing interest in Linux systems. After relying mainly on social engineering for two years, Silent Lynx appears to be building a more advanced set of attack tools. Full joint Virus Bulletin paper with full indicators of compromise, malware hashes, and infrastructure details is available here. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, SILENT LYNX)
A proxyjacking campaign has impacted devices in 34 countries, monetizing victims’ internet connections through a commercial residential proxy network. The operator installed Pawns.app, a legitimate bandwidth-sharing application that lets users earn money by sharing their internet connections, on devices without the owners’ consent. Pawns.app account holders are rewarded for allowing traffic from other users to flow through their network, provided it runs on trusted, non-blocking IP addresses. By installing the app on multiple systems, the attacker likely accumulated larger payouts. Threat intelligence company GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organization, and identified at least 143 compromised devices worldwide. According to the researchers, the attacker leveraged several vulnerabilities to breach edge devices and install the Pawns.app software:
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. AUR is a community-maintained, widely-used package index for Arch Linux and derivative distributions that hosts package build scripts (PKGBUILDs) for third-party and proprietary tools, beta, or older package versions that are no longer available via the official Linux distribution channels. The repository has recently become a target of malicious campaigns, including an attack in June in which 400 packages distributed credential-stealing malware with rootkit capabilities. Another campaign in July prompted Arch to temporarily disable package adoption. The latest campaign was detected on October 13 and involved malicious packages uploaded by a user named “marchos1as” under typosquatted names mimicking the yay and paru command-line tools.
Confirm this action.
Leaving now will discard your changes.