A suspected state-sponsored threat actor exploited multiple Fortinet vulnerabilities to maintain long-term access to a telecommunications organization, according to a report from cybersecurity firm Palo Alto Networks. The intrusion, attributed to UNC5820 (CL-STA-0954), which took place in September 2024, leveraged previously unknown malware called PeerStitch.
The attackers initially gained access by exploiting CVE-2024-47575, a critical remote code execution (RCE) vulnerability in FortiManager known as FortiJump. The flaw allowed attackers to compromise vulnerable management systems and was patched in October 2024. Google-owned Mandiant later reported that UNC5820 had exploited the vulnerability as a zero-day since at least June 2024.
Palo Alto Networks also observed the exploitation of CVE-2025-61624, a path traversal vulnerability affecting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. Patched in April 2026, the flaw could allow authenticated attackers to write or delete arbitrary files.
During the attack, UNC5820 used FortiJump to access a central FortiManager server, register a rogue Virtual FortiGate appliance, and steal a configuration archive containing information about more than 500 managed FortiGate firewalls and the victim’s network. The attackers then exploited CVE-2025-61624 to gain root access to the underlying firewall operating system and deploy PeerStitch.
Written in C and compiled for ARM64 systems, PeerStitch operates in memory and avoids opening listening ports or establishing direct outbound network connections. Instead, it abuses traffic generated by legitimate FortiOS processes to establish a covert communication channel.
The implant modifies the memory of central system processes, traffic logging components, and IKE/IPsec VPN service daemons, helping it bypass built-in security checks.
Researchers also observed the attackers impersonating FortiManager during FortiGate-to-FortiManager (FGFM) communications to issue commands from external infrastructure. Threat actors reportedly achieved this either by exploiting CVE-2024-26008 to terminate the legitimate management session or by reusing stolen authentication secrets.