IN September 2024, threat cluster CL-STA-0954, tracked by Mandiant as UNC5820 and attributed to Unit 42, breached a telecommunications managed service provider by exploiting Fortinet’s FortiJump vulnerability, CVE-2024-47575. The attackers gained access via a central FortiManager server, registered a rogue virtual FortiGate, and subsequently exfiltrated a hidden archive containing SQLite databases, private keys, and configurations for more than 500 downstream FortiGate firewalls.
Fortinet later issued patches for CVE-2024-47575, and CISA added the flaw to the Known Exploited Vulnerabilities catalog in October 2024. The operation culminated in the deployment of PEERSTITCH malware into firewall memory through a second vulnerability, CVE-2025-61624, used via the FortiOS auto-script engine to achieve memory-based compromise.
PEERSTITCH, a 64-bit Linux ARM64 in-memory process injector, then targeted the logging daemon and the IPsec VPN daemon. The malware performs a sequence of memory actions: attaching to running processes, allocating a read-write-execute buffer, patching memory offsets to disable tamper checks, redirecting execution to a hook buffer, and deleting disk traces.
Importantly, it leaves no disk resident binary, opens no listening ports, and makes no outbound network connections; instead, it communicates through inter-process activity generated by legitimate system processes, enabling covert data handling and persistence.
The infection chain also included a fallback channel via the Apache domain management module, enabling an outbound SSH reverse shell and credential theft, with attackers impersonating the central FortiManager server to harvest configurations from other firewalls. Defence guidance emphasises volatile-memory hunting, credential rotation across all managed devices, and isolating management ports, as patching CVEs alone does not evict intruders.