A suspected state-sponsored group has exploited multiple vulnerabilities in Fortinet products to infiltrate a telecommunications organization, according to a report by Palo Alto Networks. The attack, attributed to the threat actor known as UNC5820, resulted in prolonged unauthorized access to the targeted network.
Initial Breach through FortiManager Exploit
The intrusion began in September 2024, when UNC5820 gained initial access by leveraging a critical remote code execution vulnerability in FortiManager, identified as CVE-2024-47575. This flaw was patched in October 2024, but not before it was actively exploited, as reported by cybersecurity firm Mandiant, which labeled the vulnerability ‘FortiJump’.
Subsequent findings by Palo Alto Networks revealed that UNC5820 also took advantage of another vulnerability, CVE-2025-61624, which involves path traversal and affects several Fortinet products. This particular exploit, patched in April 2026, allows authenticated attackers to manipulate files arbitrarily.
Deployment of PeerStitch and Advanced Techniques
The attack’s sophistication was further highlighted by the deployment of PeerStitch, an advanced FortiGate implant. Running on ARM64 architecture, this malware operates in memory, thereby avoiding traditional detection methods by not opening listening ports or making outbound network connections. It cleverly utilizes legitimate process traffic to communicate, maintaining stealth.
By exploiting FortiJump, the attackers accessed a central FortiManager system, registered a rogue Virtual FortiGate appliance, and extracted a configuration archive that included data on over 500 managed FortiGate firewalls and details of the victim’s network infrastructure. The path traversal vulnerability was used to achieve root access, facilitating the deployment of PeerStitch.
Implications and Future Outlook
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since added CVE-2025-61624 to its Known Exploited Vulnerabilities list, urging immediate action to patch affected systems. The incident underscores the growing sophistication of edge-device malware, as demonstrated by the PeerStitch implant’s ability to evade conventional security measures.
Palo Alto Networks noted that the attackers exhibited technical prowess by masquerading as FortiManager during communications, thereby issuing commands from external infrastructure and systematically removing forensic traces. Such attacks stress the urgent need for improved cybersecurity measures and continuous monitoring to safeguard against evolving threats.
As cybersecurity threats become increasingly complex, organizations must prioritize timely patching and reinforce their security protocols. This incident serves as a stark reminder of the critical importance of vigilance and proactive defense strategies in protecting sensitive data and infrastructure.
