Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

Unit 42 has detailed a prolonged breach of a telecom managed-service provider carried out by the cluster tracked as UNC5820 (also called CL-STA-0954). The attackers first abused CVE-2024-47575 to compromise a FortiManager appliance, registering a rogue virtual FortiGate device and stealing an archive containing configurations, credentials, cryptographic material and inventory data for over 500 managed FortiGate firewalls. After cracking reversible credentials and establishing VPN access, they exploited a second flaw, CVE-2025-61624, a path-traversal bug in the FortiOS auto-script engine, to gain root and plant PEERSTITCH, a new ARM64 Linux implant that runs only in memory, hooks the miglogd and iked daemons via ptrace injection, and communicates covertly through legitimate process traffic rather than its own network connections, making it very hard to spot with standard tools. The actors also abused Apache's ACME mod_md feature for a reverse-shell C2 channel and apparently impersonated FortiManager itself to pull configurations from other firewalls, underscoring how compromising one central management platform can expose an entire managed fleet, including client networks, well beyond the point where the original flaw is patched.