Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack

Palo Alto Networks has detailed a September 2024 intrusion against a telecom operator, attributed to the suspected state-backed actor UNC5820 (internally tracked as CL-STA-0954), which combined two Fortinet vulnerabilities to establish long-lasting, hard-to-detect access. The attackers first broke in through CVE-2024-47575, a critical FortiManager remote-code-execution zero-day patched in October 2024, which they used to reach a central FortiManager instance, set up a bogus Virtual FortiGate device, and steal configuration data covering more than 500 managed FortiGate firewalls. They then leveraged a separate path-traversal flaw, CVE-2025-61624, affecting FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, to obtain root access on a firewall's underlying OS and install a newly identified implant named PeerStitch. Written in C for ARM64, PeerStitch runs purely in memory, avoids opening or initiating network connections, and hijacks traffic from legitimate FortiOS services to create a covert communication channel while impersonating FortiManager and erasing forensic traces. CISA has since added CVE-2025-61624 to its Known Exploited Vulnerabilities list, pressing federal agencies to apply Fortinet's fix without delay.