CL-STA-0954 (UNC5820) chains FortiJump and CVE-2025-61624 to deploy memory-resident PEERSTITCH on FortiGate in telecom MSP intrusion

Linha do tempo

1. unit42.paloaltonetworks.com ↗ · pub. 14/10/2026 19:00 · coletado 19/10 17:56

   CL-STA-0954 (UNC5820) chains FortiJump and CVE-2025-61624 to deploy memory-resident PEERSTITCH on FortiGate in telecom MSP intrusion

   This is the primary Unit 42 report behind the earlier news coverage. It adds IOCs (attacker IPs, rogue device serial, staging URL and filenames), the full PEERSTITCH injection and IPC mechanics, and the Apache mod_md ACME reverse-shell C2. It also covers the traffic sniffing campaign, FGFM impersonation with CVE-2024-26009 and CVE-2024-26008 as possible vectors, detailed anti-forensics, detection guidance and the Palo Alto Networks signature IDs. The scope is stated as a telecom managed service provider, with the client networks not examined.

   ler a análise desta fonte ocultar

   This is the primary Unit 42 report behind the earlier news coverage. It adds IOCs (attacker IPs, rogue device serial, staging URL and filenames), the full PEERSTITCH injection and IPC mechanics, and the Apache mod_md ACME reverse-shell C2. It also covers the traffic sniffing campaign, FGFM impersonation with CVE-2024-26009 and CVE-2024-26008 as possible vectors, detailed anti-forensics, detection guidance and the Palo Alto Networks signature IDs. The scope is stated as a telecom managed service provider, with the client networks not examined.

   Unit 42 detailed a multi-stage intrusion in September 2024 against a telecommunications managed service provider, tracked as CL-STA-0954 (aka UNC5820). The attackers gained initial access by exploiting CVE-2024-47575 (FortiJump) on a central FortiManager and exfiltrated an archive with running configurations, credentials and private keys for more than 500 managed FortiGate firewalls, including client devices. They later used CVE-2025-61624, a FortiOS auto-script path traversal, to gain root and deploy PEERSTITCH, a novel memory-resident ARM64 implant. Post-exploitation tradecraft overlaps with suspected nation-state intrusions. Unit 42 did not examine the client networks, so exposure of those networks is limited to configuration and credential material, not confirmed intrusion.

   Technical Details

   • Initial access: CVE-2024-47575 allows unauthenticated command execution via the FGFM channel (TCP 541). The attackers registered a rogue Virtual FortiGate named localhost (serial FMG-VMTM23017412) from 45.32.41[.]202, later 198.199.122[.]22, and exfiltrated a .tm archive. It held configs, global.db and revinfo.db SQLite databases, a serial/public IP inventory, topology data, ciphertext admin and SSL/VPN credentials, and private keys.
   • Reconnaissance: After an extended dwell period, the attackers pushed sniffer configurations through FortiManager to downstream FortiGates. They captured unencrypted HTTP, 11 other services, and TFTP (UDP 69), RADIUS (UDP 1812/1813) and LDAP (TCP 389) on core perimeter firewalls.
   • Re-entry: Reversible ciphertext credentials were brute-forced offline. The attackers then opened SSL/VPN sessions from 23.240.77[.]233 and 47.18.167[.]159.
   • Privilege escalation: CVE-2025-61624 lets an authenticated admin write files as root via an unsanitized system.auto-script object name (e.g. ../../../../setup).
   • PEERSTITCH: a statically linked C ARM64 one-shot injector (lldprx, downloaded from hxxp[:]//23.240.77[.]233:8085/ together with pM.js, index.js, index.wasm and ipssem.js). It uses ptrace to inject into /bin/miglogd and /bin/iked via an RWX mmap buffer. It NOP-patches three offsets and builds a covert IPC bridge through /proc/<pid>/mem, using markers 8550 and 169.254.0.1. This lets tagged VPN sessions bypass FortiOS security validations. It leaves no binary on disk, opens no listening ports and makes no outbound connections.
   • Second C2: The attackers abused Apache mod_md ACME on FortiGate. They wrote md-acme.conf with MDChallengeDns01 mapped to /bin/node and MDRenewMode always, injecting an SSH reverse shell to 23.240.77[.]233:8084.
   • FGFM impersonation: A FortiGateCloud admin account downloaded configs from managed firewalls. Unit 42 assesses with medium confidence the attackers impersonated FortiManager, either via CVE-2024-26009 (FGFM authentication bypass) or by reusing the exfiltrated trust material. CVE-2024-26008 may have been used to force session drops. FortiCloud SSO issues (FG-IR-26-060) were excluded.
   • Anti-forensics: They killed miglogd and syslogd, cleared crash logs, deleted rogue admins, VPN groups and auto-script objects, overwrote md-acme.conf with decoy content, and had lldprx unlink itself.

   Remediation

   • Patch FortiManager and FortiOS for CVE-2024-47575 and CVE-2025-61624, and review exposure of FGFM (TCP 541).
   • Treat all credentials, certificates and private keys held by a compromised management platform as compromised, and rotate them, since the trust material stays valid until rotated.
   • Isolate edge management interfaces with strict zero-trust controls and hunt for PEERSTITCH in memory (see Unit 42 Table 2, hashes and network IOCs, and YARA rule).
   • Palo Alto Networks Threat Prevention signatures 95788 and 96788 cover CVE-2024-47575.
2. securityweek.com ↗ · pub. 19/10/2026 08:13 · coletado 19/10 17:53 primeiro registro

   UNC5820 chains FortiJump and CVE-2025-61624 to deploy stealthy PeerStitch FortiGate implant in telecom intrusion

   ler a análise desta fonte ocultar

   A suspected state-sponsored actor, UNC5820 (tracked by Palo Alto Networks as CL-STA-0954), compromised a telecommunications organization in September 2024 and kept long-term access. Initial access came through the FortiManager RCE flaw CVE-2024-47575 (FortiJump). A new Palo Alto Networks report shows the actor also exploited CVE-2025-61624, a path traversal bug in several Fortinet products, apparently as a zero-day, to deploy a previously unknown ARM64 FortiGate implant, PeerStitch. On Friday CISA added CVE-2025-61624 to its KEV catalog and told federal agencies to patch immediately.

   Technical Details

   • FortiJump (CVE-2024-47575) gave access to a central FortiManager. The actor registered a rogue Virtual FortiGate appliance and exfiltrated a configuration archive covering FortiManager, more than 500 managed FortiGate firewalls and the victim network. Mandiant had earlier reported exploitation since at least June 2024.
   • CVE-2025-61624 affects FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. It was patched in April 2026 and allows authenticated attackers to write or delete arbitrary files. The actor used it to gain root on the firewall OS and drop a script that started the PeerStitch deployment.
   • PeerStitch is written in C and is memory-resident. It acts as a one-shot process memory patching injector that targets the central system and traffic logging daemon and the IKE/IPsec VPN service daemons. It builds a covert in-memory communication bridge between them and bypasses default FortiOS security validations. It opens no listening ports, makes no outbound connections, and communicates through traffic generated by legitimate processes on the appliance.
   • The actor impersonated FortiManager in FGFM communications to issue commands from external infrastructure. It took the management identity either by terminating the legitimate FortiManager session via CVE-2024-26008 or by reusing exfiltrated secrets to authenticate as the legitimate FortiManager.
   • The actor took extensive measures to remove forensic artifacts.

   Remediation

   • Patch the affected Fortinet products, including CVE-2025-61624 on FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, and CVE-2024-47575 on FortiManager. CISA requires federal agencies to patch CVE-2025-61624 immediately.
   • The article gives no further specific guidance, and no IOCs are published in it.