SECURITY researchers have linked a sequence of exploited Fortinet vulnerabilities to a stealthy FortiGate implant used in a telecom intrusion. The activity began with the exploitation of a critical remote code execution flaw in FortiManager, tracked as CVE-2024-47575, a zero-day that was patched in October 2024. Palo Alto Networks’ unit tracking attributes the operation to UNC5820 (CL-STA-0954), with exploitation ongoing since at least June 2024.
A subsequent report notes the actors also leveraged CVE-2025-61624, a path traversal vulnerability affecting Fortinet products including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, patched in April 2026. The US CISA later added CVE-2025-61624 to its Known Exploited Vulnerabilities list, urging immediate patching for federal agencies.
The intrusion culminated in the deployment of a previously unknown FortiGate implant, named PeerStitch, described as an ARM64, memory-resident “one-shot process memory patching injector.” The implant operates without opening listening ports or making outbound connections, instead communicating through traffic generated by legitimate processes.
SecurityWeek reports UNC5820 used FortiJump to access a central FortiManager instance, registered a rogue Virtual FortiGate appliance, and exfiltrated a configuration archive covering FortiManager, over 500 managed FortiGate firewalls, and the victim network. PeerStitch gains root access via CVE-2025-61624, drops a script to initiate deployment, and targets IKE/IPsec VPN daemons to create a covert inter-process bridge while evading FortiOS security checks.
Palo Alto Networks notes the group also terminated FortiManager sessions or reused exfiltrated secrets to impersonate FortiManager, and took measures to erase forensic traces.