CL-STA-0954 exploits FortiOS CVE-2025-61624 to deploy memory-resident ARM64 implant PEERSTITCH after FortiJump breach
Palo Alto Networks Unit 42 reports that a suspected advanced actor tracked as CL-STA-0954 (aka UNC5820) deployed a previously unreported memory-resident ARM64 implant, PEERSTITCH, on Fortinet FortiGate firewalls. The group exploited the FortiOS path traversal flaw CVE-2025-61624 for the final stage. The intrusion hit a telecommunications …