Unit 42 links PEERSTITCH to Fortinet flaws at telecom MSP

Unit 42 says UNC5820 stole data on 500-plus FortiGates and deployed memory-resident PEERSTITCH via Fortinet flaws.

Palo Alto Networks Unit 42 says suspected cluster CL-STA-0954, also tracked as UNC5820, compromised a telecommunications managed service provider beginning in September 2024 by exploiting CVE-2024-47575 (FortiJump) on a central FortiManager, registering a rogue device, and exfiltrating material covering more than 500 managed FortiGate firewalls for the provider and its clients. Sources describe that archive differently as running configurations, certificates, private keys, and databases; configurations, credentials, and trust material; recoverable administrative and SSL VPN credentials and private keys; or configurations, certificates, private keys, and an inventory. The attackers later exploited CVE-2025-61624, described as a FortiOS auto-script or authenticated path-traversal flaw and said by The Hacker News to have been patched in April 2026, to deploy PEERSTITCH; GBHackers says Fortinet lists FortiOS 7.4.10 and 7.6.5 as fixes. Unit 42 describes PEERSTITCH as a memory-resident ARM64 implant with no on-disk binary and no listening ports that communicates through legitimate-process traffic, while later reports say it is fileless and injected with ptrace into miglogd and iked, and The Hacker News adds that the hooks bypass checks on tagged SSL VPN sessions. Operators also pushed packet-capture rules, established VPN sessions, and impersonated FortiManager; Unit 42 says client networks were not confirmed to have been separately intruded, while Security Affairs says recovered credentials were used for unauthorized SSL/VPN access. Reports further describe an SSH reverse shell through Apache mod_md or a separate malicious ACME setup, along with log disruption and deletion of staging files or rogue administrator accounts. GBHackers says exploitation of CVE-2024-26009 was not confirmed, while The Hacker News lists CVE-2024-26009 and CVE-2024-26008 without describing confirmed use; Security Affairs warns that patching does not invalidate stolen keys until trust material is rotated on every managed device.

• Palo Alto Networks Unit 42 attributes the intrusion to cluster CL-STA-0954, also tracked as UNC5820, at a telecommunications managed service provider beginning in September 2024.
• Initial access used CVE-2024-47575 (FortiJump) on a central FortiManager; Unit 42 says a rogue device was registered and an archive covering more than 500 managed FortiGate firewalls was exfiltrated.
• Sources describe the stolen archive differently: running configurations, certificates, private keys, and databases; credentials and trust material; recoverable administrative and SSL VPN credentials; or an inventory.