Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack

What it is

Palo Alto Networks attributes a September 2024 telecom intrusion to UNC5820 (which it tracks as CL-STA-0954), a suspected state-sponsored actor. The attack gave the actor long-term access. It chained three Fortinet bugs and ended with PeerStitch, a previously unknown FortiGate implant. CISA added CVE-2025-61624 to its KEV list on the Friday before the article was published, and told federal agencies to patch it immediately.

How it works

1. FortiManager access. The actor exploited CVE-2024-47575 (FortiJump), a critical RCE in FortiManager. Mandiant says exploitation began by June 2024, before the October 2024 patch.
2. Fleet reconnaissance. The actor registered a rogue Virtual FortiGate appliance and exfiltrated a configuration archive. The archive held details of FortiManager, more than 500 managed FortiGate firewalls and the victim's network.
3. Root on the firewall. The actor used CVE-2025-61624, a path traversal that lets an authenticated attacker write or delete arbitrary files. This gave root on the underlying OS, and a dropped script started the PeerStitch deployment. Palo Alto believes this was a zero-day at the time of the intrusion.
4. PeerStitch. The implant is written in C for ARM64 and runs only in memory. It is a "one-shot process memory patching injector". It patches the central system and traffic logging daemon and the IKE/IPsec VPN daemons, which creates a covert bridge between them and bypasses default FortiOS security validations. It opens no listening ports and makes no outbound connections. It communicates through traffic that legitimate processes on the appliance already generate.
5. FortiManager impersonation. The actor issued commands over FGFM (FortiGate-to-FortiManager) from external infrastructure. It took over the management identity in one of two ways: by ending the real FortiManager's session with CVE-2024-26008, or by reusing exfiltrated secrets to authenticate as the legitimate FortiManager. The page says the actor "took extensive measures to eliminate forensic artifacts".

Preconditions / Affected

• CVE-2024-47575 affects FortiManager.
• CVE-2025-61624 affects FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. Fortinet patched it in April 2026 and flagged it as exploited at disclosure. It needs authentication, which in this case came from the earlier FortiManager compromise.
• The scale of exposure comes from FortiManager's central role: one compromised instance exposed configuration data for every firewall it managed.

What to do

The page gives patching as the only action: apply the fixes for CVE-2025-61624 and the earlier FortiManager flaws. It names no fixed version numbers, and no commands, indicators of compromise or detection queries.

Caveats

• The implant is memory-resident and leaves no persistent disk artifacts, so Palo Alto says it evades traditional monitoring. The article offers no way to detect it.
• Anyone whose FortiManager was exposed before the October 2024 patch should consider that configuration archives and secrets may have been stolen. Stolen secrets allow FortiManager impersonation without any exploit. The article does not say whether rotating them is advised.