/
ttps_attack:T1055.008 × limpar

Resultados

2 casos · pág. 1/1

thehackernews.com · high

CL-STA-0954 exploits FortiOS CVE-2025-61624 to deploy memory-resident ARM64 implant PEERSTITCH after FortiJump breach

Palo Alto Networks Unit 42 reports that a suspected advanced actor tracked as CL-STA-0954 (aka UNC5820) deployed a previously unreported memory-resident ARM64 implant, PEERSTITCH, on Fortinet FortiGate firewalls. The group exploited the FortiOS path traversal flaw CVE-2025-61624 for the final stage. The intrusion hit a telecommunications …

CVE-2025-61624 CVE-2024-47575 CVE-2024-26009 CL-STA-0954 UNC5820 telecommunications managed service providers
unit42.paloaltonetworks.com · · 2 fontes · 2 atualizações high

CL-STA-0954 (UNC5820) chains FortiJump and CVE-2025-61624 to deploy memory-resident PEERSTITCH on FortiGate in telecom MSP intrusion

Unit 42 detailed a multi-stage intrusion in September 2024 against a telecommunications managed service provider, tracked as CL-STA-0954 (aka UNC5820). The attackers gained initial access by exploiting CVE-2024-47575 (FortiJump) on a central FortiManager and exfiltrated an archive with running configurations, credentials and private keys …

CVE-2024-47575 CVE-2025-61624 CVE-2024-26008 UNC5820 CL-STA-0954 telecommunications