A suspected state-sponsored threat actor exploited multiple Fortinet vulnerabilities in an attack against a telecommunications organization, Palo Alto Networks reports.
The intrusion, attributed to UNC5820 (tracked by Palo Alto Networks as CL-STA-0954), occurred in September 2024 and resulted in long-term access to the victim’s environment.
Initial access was obtained through the exploitation of a critical remote code execution (RCE) bug in FortiManager, tracked as CVE-2024-47575 and patched in October 2024 as a zero-day.
Shortly after the patches were rolled out, Mandiant warned that UNC5820 had been exploiting the flaw, named FortiJump, since at least June 2024.
A fresh report from Palo Alto Networks shows that UNC5820 also exploited CVE-2025-61624, a path traversal vulnerability affecting multiple Fortinet products, as part of the same intrusion.
Impacting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager and patched in April 2026, the security defect could allow authenticated attackers to write or delete arbitrary files. Fortinet flagged its exploitation as a zero-day at the time of disclosure.
On Friday, the US cybersecurity agency CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities (KEV) list, urging federal agencies to patch it immediately.
UNC5820 appears to have exploited the path traversal as a zero-day to deploy a previously unknown FortiGate implant dubbed PeerStitch.
The ARM64 malware resides in memory, avoids opening listening ports or initiating outbound network connections, and communicates through the traffic generated by legitimate processes on the appliance.
As part of the observed attack, UNC5820 exploited FortiJump to access a central FortiManager instance, registered a rogue Virtual FortiGate appliance, and exfiltrated a configuration archive containing details on FortiManager, more than 500 managed FortiGate firewalls, and the victim’s network.
UNC5820 exploited CVE-2025-61624 to gain root access to the underlying firewall operating system, dropping a script to initiate the PeerStitch deployment.
Written in C, the implant acts as a ‘one-shot process memory patching injector’ targeting the central system and traffic logging, and the IKE/IPsec VPN service daemons in FortiOS to create a covert, memory-resident communication bridge between them and bypass default FortiOS security validations.
As part of the attack, the threat actor was also seen impersonating FortiManager in FortiGate-to-FortiManager (FGFM) communications to issue commands from external infrastructure and “took extensive measures to eliminate forensic artifacts”.
According to Palo Alto Networks, UNC5820 asserted the management identity either by terminating the authentic FortiManager’s session by exploiting CVE-2024-26008, or by reusing exfiltrated secrets and authenticating as the legitimate FortiManager.
“The discovery of the PeerStitch implant demonstrates the increasing technical maturity of edge-device malware. By operating as a one-shot injector, avoiding persistent disk artifacts and building a covert inter-process communication bridge inside process memory, the attackers achieved sustained persistence while evading traditional monitoring,” Palo Alto Networks notes.
Related Content
Vulnerabilities
Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts.
Vulnerabilities
F5, Juniper Networks Patch Critical Vulnerabilities
Successful exploitation of some of these issues could lead to remote code execution and full device takeover.
Vulnerabilities
Microsoft Patches Two Dozen RCE Flaws in Office
In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in Office.
Vulnerabilities
Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
The company says it’s aware of limited exploitation against customers’ firewalls, and it has made IoCs available.
Email Security
Cisco Warns of Exploited Secure Email Gateway Vulnerability
Unauthenticated, remote attackers could write arbitrary files to the operating system and execute commands with root privileges.
Vulnerabilities
Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise
Mozilla has introduced Firefox Enterprise for organizations with strict compliance, governance, and security requirements.
Vulnerabilities
Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products
Critical-severity flaws could lead to authentication bypass, code execution, and sensitive authentication information leaks.
Vulnerabilities
Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
The most important is CVE-2026-96951, a security feature bypass flaw in Windows that has been exploited in the wild.
