A suspected state-sponsored threat actor exploited multiple Fortinet vulnerabilities in an attack against a telecommunications organization, Palo Alto Networks reports.
The intrusion, attributed to UNC5820 (tracked by Palo Alto Networks as CL-STA-0954), occurred in September 2024 and resulted in long-term access to the victim’s environment.
Initial access was obtained through the exploitation of a critical remote code execution (RCE) bug in FortiManager, tracked as CVE-2024-47575 and patched in October 2024 as a zero-day.
Shortly after the patches were rolled out, Mandiant warned that UNC5820 had been exploiting the flaw, named FortiJump, since at least June 2024.
A fresh report from Palo Alto Networks shows that UNC5820 also exploited CVE-2025-61624, a path traversal vulnerability affecting multiple Fortinet products, as part of the same intrusion.
Impacting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager and patched in April 2026, the security defect could allow authenticated attackers to write or delete arbitrary files. Fortinet flagged its exploitation as a zero-day at the time of disclosure.
On Friday, the US cybersecurity agency CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities (KEV) list, urging federal agencies to patch it immediately.
UNC5820 appears to have exploited the path traversal as a zero-day to deploy a previously unknown FortiGate implant dubbed PeerStitch.
The ARM64 malware resides in memory, avoids opening listening ports or initiating outbound network connections, and communicates through the traffic generated by legitimate processes on the appliance.
As part of the observed attack, UNC5820 exploited FortiJump to access a central FortiManager instance, registered a rogue Virtual FortiGate appliance, and exfiltrated a configuration archive containing details on FortiManager, more than 500 managed FortiGate firewalls, and the victim’s network.
UNC5820 exploited CVE-2025-61624 to gain root access to the underlying firewall operating system, dropping a script to initiate the PeerStitch deployment.
Written in C, the implant acts as a ‘one-shot process memory patching injector’ targeting the central system and traffic logging, and the IKE/IPsec VPN service daemons in FortiOS to create a covert, memory-resident communication bridge between them and bypass default FortiOS security validations.
As part of the attack, the threat actor was also seen impersonating FortiManager in FortiGate-to-FortiManager (FGFM) communications to issue commands from external infrastructure and “took extensive measures to eliminate forensic artifacts”.
According to Palo Alto Networks, UNC5820 asserted the management identity either by terminating the authentic FortiManager’s session by exploiting CVE-2024-26008, or by reusing exfiltrated secrets and authenticating as the legitimate FortiManager.
“The discovery of the PeerStitch implant demonstrates the increasing technical maturity of edge-device malware. By operating as a one-shot injector, avoiding persistent disk artifacts and building a covert inter-process communication bridge inside process memory, the attackers achieved sustained persistence while evading traditional monitoring,” Palo Alto Networks notes.
Related: Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
Related: CikaBika Bot RAT Uses Discord for C&C
Related: Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
Related: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
