Key points
- UNC5820 exploited CVE-2024-47575 and CVE-2025-61624 to breach a telecom organization.
- Attackers exfiltrated configuration archives covering more than 500 managed FortiGate devices.
- A new memory-resident implant, PeerStitch, was deployed to evade standard detection methods.
The short version
- A telecommunications company suffered a long-term intrusion attributed to the state-sponsored group UNC5820.
- The breach involved exploiting two Fortinet vulnerabilities to steal network configuration data.
- Attackers installed a stealthy implant that hides within legitimate system traffic.
The details
Palo Alto Networks reports that UNC5820, tracked as CL-STA-0954, breached a telecommunications organization in September 2024. The group gained initial entry by exploiting CVE-2024-47575, a critical remote code execution flaw in FortiManager. Although Fortinet patched this zero-day in October 2024, Mandiant noted earlier in that month that the actors had been using the bug, dubbed FortiJump, since at least June 2024.
Following initial access, the threat actors leveraged CVE-2025-61624, a path traversal vulnerability affecting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. This defect, patched in April 2026, allowed authenticated attackers to write or delete arbitrary files. CISA added this CVE to its Known Exploited Vulnerabilities list on Friday, urging immediate remediation. The attackers used this flaw to gain root access and deploy PeerStitch, a previously unknown FortiGate implant.
The context
PeerStitch is an ARM64 malware written in C that resides entirely in memory. It avoids opening listening ports or initiating outbound connections, instead communicating through traffic generated by legitimate processes on the appliance. The implant patches the memory of central system and traffic logging daemons, as well as IKE/IPsec VPN services, to bypass default FortiOS security validations.
UNC5820 used FortiJump to access a central FortiManager instance and register a rogue Virtual FortiGate appliance. They then exfiltrated a configuration archive containing details on the FortiManager, more than 500 managed FortiGate firewalls, and the victim’s network topology. This data provides a comprehensive map of the organization’s security infrastructure.
What should you do?
- Verify if your environment runs FortiManager, FortiOS, FortiPAM, FortiProxy, or FortiSwitchManager.
- Check for the presence of CVE-2024-47575 and CVE-2025-61624 in your current software versions.
- Monitor for unauthorized Virtual FortiGate appliances or unexpected configuration changes.
- Review logs for anomalous memory usage or traffic patterns that do not match known services.
For customers and users
When infrastructure details are exposed, affected organizations should assume their network maps are compromised. Teams usually rotate all cryptographic keys and certificates associated with the exposed devices. Users should check whether their access credentials were part of the stolen configuration archives. Look for follow-up scams that reference specific internal systems or recent outages. Do not click links in emails claiming to fix the breach. Verify all change requests through out-of-band communication channels.
Background: Malware
No, they are not the same. A virus is a specific subset of malware that attaches to host files and requires execution to spread. Malware is the umbrella term for all malicious software, including worms, trojans, and spyware. Understanding this distinction dictates whether you focus on file integrity or network isolation.
Read the full guide: Is Malware and Virus the Same? A Technical Breakdown
What to do and how to stay safe: Fortinet
- Audit your Fortinet device inventory to identify any systems running unpatched versions.
- Enable enhanced logging on your firewalls to detect unusual process behavior or memory injections.
- Implement strict access controls for administrative interfaces to limit exposure to path traversal attacks.
- Once the vendor provides an update, prioritize patching critical remote code execution flaws immediately.
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Fortinet products are affected by the path traversal vulnerability?
CVE-2025-61624 affects FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager.
What data was stolen in this intrusion?
Attackers exfiltrated a configuration archive containing details on FortiManager, more than 500 managed FortiGate firewalls, and the victim’s network.
How does the PeerStitch implant communicate?
It communicates through traffic generated by legitimate processes on the appliance, avoiding outbound connections.
