CL-STA-0954 (Threat actor): news timeline & CVEs

PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager

Unit 42 says PEERSTITCH, planted through FortiManager flaws, exposed material for more than 500 firewalls.

Palo Alto Networks Unit 42 says cluster CL-STA-0954, also known as UNC5820, compromised a telecommunications managed service provider’s FortiManager in September 2024 by exploiting CVE-2024-47575, known as FortiJump. From that appliance the attackers exfiltrated configurations, credentials, and cryptographic material for more than 500 managed FortiGate firewalls covering the provider and its clients, then used the credentials for unauthorized SSL/VPN access. They later exploited CVE-2025-61624 to deploy PEERSTITCH, a fileless ARM64 implant that injects into FortiOS logging and VPN processes and leaves no binary on disk. Unit 42 warns that patching does not invalidate stolen keys until trust material is rotated on every managed device.

Security AffairsOct 16, 09:08 UTC · 21h agoThreat actor in the wild 5 sources CVE-2024-47575 CVE-2025-616241· 1 read

PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

Unit 42 says CL-STA-0954 used Fortinet flaws to deploy memory-resident PEERSTITCH against a telecom provider.

Palo Alto Networks Unit 42 says suspected cluster CL-STA-0954, also tracked as UNC5820, compromised a telecommunications managed service provider beginning in September 2024 by exploiting FortiJump, CVE-2024-47575, on FortiManager. The attackers stole configurations, certificates, private keys, and an inventory covering more than 500 managed FortiGate firewalls. They later exploited CVE-2025-61624, a FortiOS path-traversal flaw patched in April 2026, to deploy PEERSTITCH, a memory-resident ARM64 implant that uses ptrace to hook miglogd and iked and bypass checks on tagged SSL VPN sessions. The operators also disrupted logging, deleted rogue administrator accounts, and established an SSH reverse shell through Apache mod_md.

The Hacker Newsupdated Oct 16, 09:08 UTC · 21h agofirst Oct 16, 04:59 UTC · 1d agoThreat actor in the wild 5 sources CVE-2025-61624

New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory

Unit 42 details PEERSTITCH, a memory-resident implant used against FortiGate firewalls at a telecom MSP.

Unit 42 reported PEERSTITCH, a memory-resident ARM64 implant used by CL-STA-0954, also known as UNC5820, during a long intrusion at a telecommunications managed service provider. Attackers first exploited CVE-2024-47575, FortiJump, on FortiManager in September 2024 and stole configuration archives tied to more than 500 managed firewalls, including recoverable administrative and SSL VPN credentials and private keys. They later abused CVE-2025-61624 to run a loader that used ptrace to hook FortiOS processes miglogd and iked, while a separate malicious ACME setup provided an SSH reverse shell. Fortinet lists FortiOS 7.4.10 and 7.6.5 as fixes for CVE-2025-61624; researchers could not confirm exploitation of CVE-2024-26009.

GBHackersupdated Oct 16, 09:08 UTC · 21h agofirst Oct 15, 13:21 UTC · 1d agoMalware in the wild 5 sources CVE-2024-47575 CVE-2024-26009

Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls

Attackers exploited Fortinet flaws at a telecom MSP and deployed the stealthy PEERSTITCH implant on FortiGate firewalls.

Unit 42 says attackers tracked as CL-STA-0954, also known as UNC5820, compromised a telecommunications MSP’s FortiManager in September 2024 by exploiting CVE-2024-47575 (FortiJump). They stole an archive of configurations, credentials, and trust material tied to more than 500 managed FortiGate firewalls, then used recovered credentials and packet captures. Through authenticated path-traversal flaw CVE-2025-61624, they deployed PEERSTITCH, a memory-only implant injected into FortiOS processes miglogd and iked, and set up a separate reverse shell via Apache mod_md.

Cyber Security Newsupdated Oct 16, 09:08 UTC · 21h agofirst Oct 15, 12:22 UTC · 1d agoMalware in the wild 5 sources CVE-2024-47575 CVE-2025-61624

Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

Unit 42 says UNC5820 stole data on 500-plus FortiGates and deployed memory-resident PEERSTITCH malware.

Unit 42 investigated a September 2024 intrusion at a telecommunications managed service provider attributed to cluster CL-STA-0954, also known as UNC5820. Attackers exploited CVE-2024-47575 (FortiJump) on a central FortiManager, registered a rogue device, and exfiltrated an archive with running configurations, certificates, private keys, and databases covering more than 500 managed FortiGate firewalls. They later exploited CVE-2025-61624 through FortiOS auto-script path traversal to deploy PEERSTITCH, a memory-resident ARM64 implant that leaves no on-disk binary, opens no listening ports, and communicates through traffic from legitimate processes. The attackers also pushed packet-capture rules, established VPN sessions, and impersonated FortiManager; Unit 42 says client networks were not confirmed to be separately intruded.

Palo Alto Unit 42updated Oct 16, 09:08 UTC · 21h agofirst Oct 14, 22:00 UTC · 2d agoThreat actor in the wild 5 sources

CL-STA-0954

Timeline5 articles

Related CVEsby mentions

Appears with

PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager

PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory

Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls

Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant