UNC5820 deploys PeerStitch implant via Fortinet CVE-2025-61624

1. Executive summary

A cluster tracked by Palo Alto Networks Unit 42 as CL-STA-0954 (also designated UNC5820) compromised a telecommunications managed service provider in September 2024, using CVE-2024-47575 (CVSS 9.8 critical, in CISA KEV since 2024-10-23, EPSS 95%) to breach a central FortiManager appliance and exfiltrate configuration and credential material for more than 500 managed FortiGate firewalls. During the same intrusion the actor exploited CVE-2025-61624 (CVSS 6.0 medium, in CISA KEV since 2026-10-16, EPSS 1%) as a zero-day to gain root on FortiOS and deploy PeerStitch, a memory-resident ARM64 implant that opens no listening ports and makes no outbound connections. CVE-2024-26008 (CVSS 5.3 medium, not in CISA KEV, EPSS 1%) was used to terminate the legitimate FortiManager session so the actor could impersonate it in FortiGate-to-FortiManager communications. EMEA financial services firms that run FortiManager or managed FortiGate estates, directly or through an MSP, carry the exposure: the stolen material is management-plane configuration and cryptographic secrets, not customer data, but it is enough to reach every firewall the compromised manager controlled. Attribution to a state-sponsored actor is assessed by Unit 42 and is unconfirmed; UNC5820 has no MITRE ATT&CK profile.

2. Regulatory framing

3. Technical analysis & attack chain

The intrusion ran against a telecommunications managed service provider. Unit 42 examined the provider's own environment and did not examine the client networks whose firewalls the provider managed, so the exposure described is of configuration and credential material rather than confirmed intrusion into those client networks.

1. The actor sent crafted requests to the FortiManager FMG-Access management channel on TCP port 541, exploiting CVE-2024-47575 (FortiJump) to execute arbitrary commands without authentication.
2. The actor registered a rogue Virtual FortiGate appliance named localhost, serial number FMG-VMTM23017412, to the central FortiManager. The registration originated from 45.32.41[.]202, later changed to 198.199.122[.]22.
3. Immediately after registration the actor generated a configuration archive named .tm in the FortiManager file system and exfiltrated it. The archive held the FortiManager's own serial number and its management relationships to every enrolled device, complete running configurations for more than 500 managed FortiGate firewalls across internal and client networks, and central management SQLite databases including global.db.
4. The actor exploited CVE-2025-61624 through the FortiOS auto-script path traversal to gain root on the underlying firewall operating system, then dropped a script to start the PeerStitch deployment.
5. PeerStitch, written in C and built for ARM64, ran as a one-shot process memory patching injector. It patched the central system and traffic logging daemons and the IKE/IPsec VPN service daemons in FortiOS, creating a memory-resident communication bridge between them and bypassing default FortiOS security validations.
6. To issue commands from external infrastructure, the actor impersonated the FortiManager in FortiGate-to-FortiManager (FGFM) communications. It asserted the management identity either by terminating the authentic FortiManager's session through CVE-2024-26008 or by reusing exfiltrated secrets to authenticate as the legitimate manager.
7. The actor took extensive measures to remove forensic artifacts. Unit 42 reports the actor maintained long-term access, intercepted network traffic, established VPN sessions and deployed backdoors.

The implant's design is what defeats conventional monitoring. PeerStitch leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections. Its command channel is the traffic already generated by legitimate FortiOS processes, so a network sensor sees ordinary appliance traffic and an endpoint agent has no file to scan. Detection has to come from the integrity of the appliance's own processes and from the management plane: unexpected FGFM sessions, a FortiManager identity asserted from an address that is not the manager, and auto-script execution on FortiOS.

CVE-2025-61624 is recorded as CVSS 6.0 medium in NVD, while the reporting describes it as allowing authenticated attackers to write or delete arbitrary files across FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, patched in April 2026 and exploited as a zero-day. The medium score reflects the authentication precondition; in this intrusion the actor already held root-equivalent reach from step 1, so the precondition cost nothing. CVE-2024-26008 is recorded as CWE-754 in NVD; the reporting describes its use as terminating the authentic FortiManager session, and the two descriptions are consistent with an unhandled condition in session handling.

Attribution caveat: the state-sponsored assessment and the UNC5820 / CL-STA-0954 designation rest on Unit 42's reporting, corroborated in outline by SecurityWeek's coverage of the same report. No MITRE ATT&CK profile exists for UNC5820, so technique mapping to ATT&CK is not available and the attribution is unconfirmed. The IOC set below is single-sourced to Unit 42; verify before enforcement.

4. Mitigation & containment

P1, within 24 hours:

• Inventory every FortiManager instance and confirm its patch level against CVE-2024-47575. Treat any FortiManager that was internet-reachable on TCP 541 before October 2024 as potentially compromised, not merely unpatched.
• On FortiManager, review the managed-device list for rogue registrations. Look for a device named localhost or serial FMG-VMTM23017412, and for any device registered from an address outside your management ranges. Remove confirmed rogue entries.
• Search FortiManager file systems for an archive named .tm and preserve any copy before deletion.
• Block 45.32.41[.]202 and 198.199.122[.]22 at egress and at the management perimeter, and review historical logs for both.
• Patch FortiOS, FortiPAM, FortiProxy and FortiSwitchManager against CVE-2025-61624 to the fixed releases named in Fortinet's April 2026 advisory. Where a device cannot be patched immediately, disable FortiOS auto-script execution on appliances that do not require it.
• Rotate every secret contained in the exfiltrated configuration archive: FortiManager administrative credentials, device management credentials, IPsec pre-shared keys and certificates, and any API tokens present in the running configurations. Rotation is the only control that removes the actor's ability to authenticate as the legitimate manager.

P2, within 72 hours:

• Audit FGFM traffic. Alert on any session where the asserted FortiManager identity does not match the manager's known address, and on FortiGate devices accepting management commands from an unexpected source.
• On FortiGate appliances managed by an affected provider, capture and compare running process memory against a known-good baseline where the platform allows it. PeerStitch has no on-disk artifact, so a file-integrity scan will return clean on an infected device.
• Ask any MSP that manages your FortiGate estate directly whether it operates FortiManager, whether it was affected, and what management-plane secrets it holds on your behalf.

P3, within 7 days:

• Add the detection rules in section 6 to appliance and SIEM monitoring.
• Review DORA Art. 28 and Art. 30 arrangements with the provider: notification timelines, the provider's obligation to disclose management-plane secret exposure, and audit rights over the manager.
• Where the provider cannot confirm or deny exposure, treat the management channel to your estate as untrusted until secrets are rotated and the manager is rebuilt or verified.

5. Indicators of compromise

The IOC set is single-sourced to Unit 42; verify before enforcement. No file hashes are available in the source material.

ipv4  45.32.41[.]202
ipv4  198.199.122[.]22
filename  .tm
device_name  localhost
serial  FMG-VMTM23017412
file_path  global.db

Behavioural indicators:

6. Detection

The sources give file names, a device name, a serial number and a database name, but no distinctive strings from inside the PeerStitch binary, no command-line flags and no mutex names. A YARA rule built on .tm, localhost or global.db would match legitimate Fortinet artefacts and produce false positives across every managed estate, so no YARA rule is emitted. Detection rests on the behavioural Sigma rules below.

title: FortiManager Rogue Virtual FortiGate Registration
id: 8f2c1a44-6b7e-4c1d-9a3e-2d5f7b9c0e11
status: experimental
description: Detects registration of a Virtual FortiGate to FortiManager from an external address, consistent with CL-STA-0954 initial access via CVE-2024-47575
author: Adverse Trace
date: 2026-10-19
references:

  - https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
logsource:
  product: fortinet
  service: fortimanager
detection:
  selection_name:
    device_name: 'localhost'
  selection_serial:
    serial: 'FMG-VMTM23017412'
  condition: selection_name or selection_serial
falsepositives:

  - Administrative registration of a device genuinely named localhost in a lab
level: high

title: FortiManager Configuration Archive Creation
id: 3b9d5e21-7c4a-4f88-b2d6-1e0a8c4f6d22
status: experimental
description: Detects creation of a configuration archive named .tm in the FortiManager file system, the exfiltration staging artefact reported by Unit 42
author: Adverse Trace
date: 2026-10-19
references:

  - https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
logsource:
  product: fortinet
  service: fortimanager
detection:
  selection:
    file_name: '.tm'
  condition: selection
falsepositives:

  - Unknown
level: high

title: FortiGate FGFM Manager Identity Mismatch
id: c47a0f63-2e18-4d5b-8a91-6f3c9b2d7e33
status: experimental
description: Detects FortiGate-to-FortiManager sessions where the asserted manager identity originates from an address other than the legitimate FortiManager, consistent with CL-STA-0954 impersonation
author: Adverse Trace
date: 2026-10-19
references:

  - https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
logsource:
  product: fortinet
  service: fortigate
detection:
  selection:
    action: 'fgfm'
    src_ip:

      - '45.32.41.202'
      - '198.199.122.22'
  condition: selection
falsepositives:

  - None expected; these addresses are attacker infrastructure
level: critical

The third rule uses the two attacker addresses as exact strings, which is correct for a Sigma network match. The first two rules key on the device name, serial and archive name reported by Unit 42; confirm the exact field names against your FortiManager log schema before deployment, and expect tuning on the .tm rule if your environment uses that name legitimately.

CVE assessment

3 referenced CVEs — 2 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• Palo Alto Networks Unit 42, "Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant", https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/, accessed 2026-10-19
• SecurityWeek, "Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack", https://www.securityweek.com/exploited-fortinet-bug-linked-to-stealthy-fortigate-implant-in-telecom-hack/, published 2026-10-19
• The Register, "Three critical Fortinet sandbox bugs splattered by unknown attackers", https://www.theregister.com/security/2026/06/16/three-critical-fortinet-sandbox-bugs-splattered-by-unknown-attackers/5256461, published 2026-06-16 (context on Fortinet appliance exploitation only; the FortiSandbox CVEs it covers are not part of this intrusion)

8. Adverse Trace position

Adverse Trace assesses CVE-2024-47575 at CVSS 9.8 critical, in CISA KEV since 2024-10-23 with EPSS 95%, as the primary exposure for any firm still running an unpatched or unverified FortiManager, and CVE-2025-61624 at CVSS 6.0 medium, in CISA KEV since 2026-10-16 with EPSS 1%, as the second-stage root path that matters only once an actor is already inside the management plane. CVE-2024-26008 at CVSS 5.3 medium, not in CISA KEV, is the session-termination step that lets an actor impersonate the manager. Client impact for EMEA financial services concentrates in firms that outsource FortiGate management: the stolen material is management-plane configuration and cryptographic secrets for more than 500 firewalls, and Unit 42 did not examine the client networks, so exposure is confirmed at the credential level and unconfirmed at the intrusion level. Attribution to a state-sponsored actor is Unit 42's assessment and is unconfirmed; UNC5820 has no MITRE ATT&CK profile. The IOC set is single-sourced to Unit 42 and should be verified before enforcement. We will track CISA KEV additions and Fortinet advisories for the affected product lines, and we will update this advisory if Unit 42 or Fortinet publishes atomic indicators or a PeerStitch sample suitable for a file-based detection rule. Clients who outsource FortiGate management should open the provider conversation in section 4 P2 this week and rotate management-plane secrets before that conversation concludes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.