cyber.hendryadrian.com
Threat Research · securityweek.com

Fortinet Zero-Days Used to Deploy PeerStitch Implant in Telecom Intrusion

· Original article ↗

Summary

Palo Alto Networks reports that suspected state-sponsored actor UNC5820 exploited Fortinet vulnerabilities in a telecom intrusion, gaining long-term access and deploying the memory-resident PeerStitch implant.

Key points

  • Palo Alto Networks attributes the September 2024 intrusion to suspected state-sponsored actor UNC5820, also tracked as CL-STA-0954.
  • UNC5820 reportedly used CVE-2024-47575, the FortiManager RCE flaw known as FortiJump, to access a central FortiManager and register a rogue Virtual FortiGate appliance.
  • The actor exfiltrated a configuration archive containing information about FortiManager, more than 500 managed FortiGate firewalls, and the victim’s network.
  • Palo Alto Networks says UNC5820 also exploited CVE-2025-61624, a path traversal flaw affecting multiple Fortinet products, to gain root access and deploy PeerStitch.
  • PeerStitch is an ARM64 implant that resides in memory, avoids listening ports and outbound connections, and uses traffic from legitimate appliance processes for communication.
  • The implant patches process memory to create a covert communication bridge involving FortiOS services; the actor also impersonated FortiManager in FGFM communications and sought to remove forensic artifacts.

Article Details

Attack Vectors
  • UNC5820 exploited CVE-2024-47575 (FortiJump), a FortiManager remote code execution vulnerability, to gain initial access.
  • UNC5820 also exploited CVE-2025-61624, a path traversal vulnerability, to gain root access to the firewall operating system and deploy the PeerStitch implant.
  • The actor registered a rogue Virtual FortiGate appliance and impersonated FortiManager in FGFM communications to issue commands from external infrastructure.
  • UNC5820 exfiltrated a configuration archive containing information about FortiManager, more than 500 managed FortiGate firewalls, and the victim’s network.
Defensive Notes
  • CVE-2024-47575 was patched in October 2024.
  • CVE-2025-61624 affects FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager; Fortinet patched it in April 2026.
  • CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities list and urged federal agencies to patch it immediately.

MITRE ATT&CK

T1005 · Data from Local SystemUNC5820 collected a configuration archive containing details about FortiManager, managed FortiGate firewalls, and the victim’s network.T1055 · Process InjectionPeerStitch acts as a one-shot process-memory patching injector targeting FortiOS system, traffic-logging, and IKE/IPsec VPN service daemons.T1059 · Command and Scripting InterpreterAfter exploiting CVE-2025-61624, UNC5820 dropped a script to initiate PeerStitch deployment.T1068 · Exploitation for Privilege EscalationUNC5820 exploited CVE-2025-61624 to gain root access to the underlying firewall operating system.T1190 · Exploit Public-Facing ApplicationUNC5820 exploited CVE-2024-47575, a FortiManager RCE vulnerability, to obtain initial access.

CVE

CVE-2024-26008the management identity either by terminating the authentic FortiManager’s session by exploiting CVE-2024-26008, or by reusing exfiltrated secrets and authenticating as the legitimate FortiManager.CVE-2024-47575Initial access was obtained through the exploitation of a critical remote code execution (RCE) bug in FortiManager, tracked as CVE-2024-47575 and patched in October 2024 as a zero-day.CVE-2025-61624A fresh report from Palo Alto Networks shows that UNC5820 also exploited CVE-2025-61624, a path traversal vulnerability affecting multiple Fortinet products, as part of the same intrusion.

Threat Actors

CL-STA-0954Palo Alto Networks' tracking designation for UNC5820.UNC5820Suspected state-sponsored actor attributed with the September 2024 intrusion and exploitation of Fortinet vulnerabilities.

Malware

PEERSTITCHUNC5820 appears to have exploited the path traversal as a zero-day to deploy a previously unknown FortiGate implant dubbed PeerStitch.

Vendors

FortinetA suspected state-sponsored threat actor exploited multiple Fortinet vulnerabilities in an attack against a telecommunications organization, Palo Alto Networks reports.

Products

FortiManagerInitial access was obtained through the exploitation of a critical remote code execution (RCE) bug in FortiManager, tracked as CVE-2024-47575 and patched in October 2024 as a zero-day.Fortinet FortiGateUNC5820 appears to have exploited the path traversal as a zero-day to deploy a previously unknown FortiGate implant dubbed PeerStitch.FortiOSImpacting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager and patched in April 2026, the security defect could allow authenticated attackers to write or delete arbitrary files. Fortinet flagged its exploitation asFortiPAMImpacting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager and patched in April 2026, the security defect could allow authenticated attackers to write or delete arbitrary files. Fortinet flagged its exploitation asFortiProxyImpacting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager and patched in April 2026, the security defect could allow authenticated attackers to write or delete arbitrary files. Fortinet flagged its exploitation asFortiSwitchManagerImpacting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager and patched in April 2026, the security defect could allow authenticated attackers to write or delete arbitrary files. Fortinet flagged its exploitation as

Industries

TelecommunicationsA suspected state-sponsored threat actor exploited multiple Fortinet vulnerabilities in an attack against a telecommunications organization, Palo Alto Networks reports.

Related Articles