State Hackers Built a Ghost in Fortinet's Machine — and Stayed There for Months
A telecom operator got quietly owned in September 2024 by what looks very much like a state-backed threat group, and the attack was considerably more sophisticated than the usual smash-and-grab. Palo Alto Networks has published a detailed breakdown of the intrusion, attributed to a group it tracks as CL-STA-0954, also known to Mandiant as UNC5820.
The initial foothold came via CVE-2024-47575, the critical FortiManager remote code execution flaw that Fortinet eventually patched in October 2024 after it had already been weaponised in the wild. Mandiant flagged UNC5820's exploitation of that bug — nicknamed FortiJump — shortly after patches dropped, noting activity stretching back to at least June 2024.
But FortiJump was just the opening move.
Palo Alto's new report reveals the attackers also exploited CVE-2025-61624, a path traversal vulnerability affecting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. Fortinet patched that one in April 2026, flagging active exploitation as a zero-day at the time. CISA added it to the Known Exploited Vulnerabilities catalogue on Friday, meaning federal agencies are now on the clock to patch.
The path traversal gave UNC5820 root access to the underlying firewall OS, which they used to deploy a previously undocumented FortiGate implant called PeerStitch. Written in C and compiled for ARM64, the malware is deliberately built to be hard to spot. It lives entirely in memory, opens no listening ports, makes no outbound connections, and communicates by piggybacking on traffic generated by legitimate FortiOS processes. Forensically, it's designed to be nearly invisible.
Technically, PeerStitch functions as a one-shot process memory patching injector. It targets the central system and traffic logging daemons alongside the IKE/IPsec VPN service, stitching them together into a covert inter-process communication channel while bypassing FortiOS's default security checks. The whole thing lives in memory and leaves minimal traces on disk.
The broader attack chain is worth spelling out. Using FortiJump, the group accessed a central FortiManager instance, registered a rogue virtual FortiGate appliance, and pulled a configuration archive covering FortiManager itself, over 500 managed FortiGate firewalls, and details of the victim's network. That's a substantial intelligence haul before they'd even deployed the implant.
They also impersonated FortiManager in device-to-manager communications, allowing them to issue commands from external infrastructure. To maintain that impersonation, they either hijacked the legitimate FortiManager session by exploiting CVE-2024-26008, or simply reused the secrets they'd already exfiltrated to authenticate as the real thing.
By the time they were done, they had persistent, covert access baked into process memory, had covered their forensic tracks extensively, and had effectively turned the victim's own network management infrastructure against them.
The PeerStitch implant is a reminder that edge device compromise isn't just about initial access anymore. Sophisticated actors are building persistent footholds that survive reboots in ways traditional endpoint monitoring completely misses. If your security posture assumes the firewall is trustworthy, you may want to revisit that assumption.