Palo Alto Networks Links UNC5820 to Exploited Fortinet Bugs in Telecom Hack
A state-linked actor used patched Fortinet flaws to install a stealthy implant in a telecom firm, gaining long-term access to hundreds of firewalls.
Key points
- UNC5820 exploited CVE-2024-47575 and CVE-2025-61624 to breach a telecommunications organization in September 2024.
- The actor deployed PeerStitch, a memory-resident implant that hides by piggybacking on legitimate appliance traffic.
- CISA added the path traversal flaw to its Known Exploited Vulnerabilities list, urging immediate federal patching.
Palo Alto Networks reported that a suspected state-sponsored threat actor known as UNC5820 breached a telecommunications organization by exploiting multiple Fortinet vulnerabilities. The intrusion, which occurred in September 2024, granted the attackers long-term access to the victim’s network environment through a series of sophisticated exploits.
The group first gained initial access by targeting a critical remote code execution flaw in FortiManager, identified as CVE-2024-47575. This vulnerability was patched in October 2024 after being disclosed as a zero-day. Shortly after the patches were rolled out, Mandiant warned that UNC5820 had been exploiting the flaw, dubbed FortiJump, since at least June 2024.
Technical Execution and Malware Deployment
According to Palo Alto Networks, the attackers also leveraged CVE-2025-61624, a path traversal vulnerability affecting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. This flaw, which allows authenticated users to write or delete arbitrary files, was patched in April 2026. Fortinet had flagged its exploitation as a zero-day at the time of disclosure.
UNC5820 used this path traversal flaw to obtain root access to the underlying firewall operating system. They dropped a script to deploy a previously unknown implant named PeerStitch. Written in C, the malware functions as a one-shot process memory patching injector. It targets central system logging and IKE/IPsec VPN service daemons to create a covert communication bridge that bypasses default FortiOS security validations.
The PeerStitch implant is designed for stealth. It resides entirely in memory and avoids opening listening ports or initiating outbound network connections. Instead, it communicates through traffic generated by legitimate processes on the FortiGate appliance, making it difficult to detect through standard network monitoring.
Impact and Data Exfiltration
The intrusion resulted in significant data exposure. UNC5820 exploited the FortiJump flaw to access a central FortiManager instance and registered a rogue Virtual FortiGate appliance. The attackers then exfiltrated a configuration archive containing details on the FortiManager, more than 500 managed FortiGate firewalls, and the victim’s broader network infrastructure.
On Friday, the US Cybersecurity and Infrastructure Security Agency added CVE-2025-61624 to its Known Exploited Vulnerabilities list. CISA urged federal agencies to patch the flaw immediately due to its active exploitation by UNC5820. The agency’s listing highlights the ongoing risk posed by the path traversal vulnerability.
What should you do?
Security teams should verify that their Fortinet devices are updated to versions that patch CVE-2024-47575 and CVE-2025-61624. Administrators should review access logs for unauthorized configuration changes or new virtual appliances. Monitoring for unusual memory usage or process behavior on FortiGate devices can help identify stealthy implants like PeerStitch.
What to do and how to stay safe: Fortinet
- Update all FortiManager and FortiGate devices to the latest patched versions to address CVE-2024-47575 and CVE-2025-61624.
- Audit FortiManager configurations for unauthorized virtual appliances or unexpected changes to managed firewall settings.
- Monitor FortiGate appliances for anomalous process memory activity that does not correlate with standard network traffic patterns.
- Review logs for signs of root access or script execution that could indicate the deployment of memory-resident implants.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2025-61624?
It is a path traversal vulnerability in Fortinet products that allows authenticated attackers to write or delete arbitrary files.
When was the telecom hack discovered?
The intrusion occurred in September 2024, though Palo Alto Networks reported it in a fresh report published recently.
How does PeerStitch communicate?
The implant communicates through traffic generated by legitimate processes on the appliance, avoiding direct outbound connections.
