As reported by The Hacker News, Palo Alto Networks Unit 42 has disclosed a sophisticated intrusion campaign — tracked as CL-STA-0954 (UNC5820) — targeting a telecommunications managed service provider. The operation chained Fortinet vulnerabilities across multiple products to deploy PEERSTITCH, a previously undocumented memory-resident ARM64 backdoor designed for stealthy, long-term access.
The Strategic Threat: Central Management as the Soft Underbelly
The most critical insight from this campaign is not any single vulnerability but the compounding risk of central management architectures. The attackers initially exploited CVE-2024-47575 (FortiJump), a critical FortiManager flaw, to compromise the management plane — then exfiltrated configuration data, credentials, and trust material for over 500 downstream FortiGate firewalls. This is not a single-device breach; it is a supply chain compromise via management infrastructure.
Once attackers hold the management plane and its cryptographic trust material, they effectively inherit the trust relationships of every managed device. This is what makes the subsequent exploitation of CVE-2025-61624 so dangerous — it is not the entry point, but a post-compromise tool for targeted escalation on specific high-value firewalls within the victim's fleet.
PEERSTITCH: Designed to Evade the Defenders' Playbook
PEERSTITCH represents a deliberate design philosophy aimed at defeating standard SOC detection logic. According to Unit 42 researchers Daniel Gott and Shawn Westfall, the malware:
This communication model effectively turns the firewall's own legitimate traffic into a covert channel. Traditional network monitoring that trusts traffic originating from perimeter devices will miss this entirely.
Vulnerability Details
| Field | Detail |
|---|---|
| CVE ID | CVE-2025-61624 |
| CVSS Score | 5.4 (Medium Severity) |
| Vulnerability Type | Path traversal in command line interpreter |
| Affected Products | FortiOS, FortiPam, FortiProxy, FortiSwitchManager |
| Prerequisites | Privileged attacker access (post-compromise escalation) |
| Patch Status | Patched by Fortinet in April 2026 |
| Active Exploitation | Yes — observed in the wild by UNC5820 against telecom MSP |
| Initial Access Vector | CVE-2024-47575 (FortiJump) — FortiManager compromise |
The medium CVSS score of 5.4 is misleading in isolation. CVE-2025-61624 requires privileged access, which lowers the base score — but in the context of this campaign, privileged access was already achieved via FortiManager compromise. Organizations that delay patching because the score appears moderate are making a critical miscalculation. In a chained exploit scenario, post-access privilege escalation flaws are force multipliers, not standalone risks.
Who Is at Risk
- Telecommunications providers and MSPs — primary targets given the intercepted traffic and VPN session manipulation objectives
- Organizations with large FortiGate fleets managed via FortiManager — especially those with 100+ enrolled devices
- Environments still running unpatched FortiManager or FortiOS versions vulnerable to CVE-2024-47575 or CVE-2025-61624
- Networks relying on SSL/VPN for remote access through Fortinet perimeter devices
Shield53 Recommendations
Immediate Actions
- Patch all Fortinet products to versions addressing both CVE-2024-47575 and CVE-2025-61624. Treat this as a critical priority regardless of the medium CVSS score on the latter.
- Audit FortiManager access logs for anomalous administrative sessions, configuration exports, or database access — particularly between mid-2024 and April 2026 when the flaw remained unpatched.
- Rotate all credentials and cryptographic material stored on or transiting FortiManager: admin passwords, SSL/VPN certificates, IPsec PSKs, and any stored local credentials for managed devices.
- Inspect FortiGate-to-FortiManager trust relationships for unauthorized enrollment or configuration drift indicating post-compromise tampering.
Detection and Hardening
- Deploy memory-based detection capabilities — fileless malware like PEERSTITCH requires memory scanning, behavioral analytics, and runtime integrity monitoring, not signature-based AV.
- Network baseline anomaly detection on firewall-originated traffic — look for unexpected volumetric changes, new destinations, or traffic patterns from FortiGate management interfaces that deviate from historical baselines.
- Segment management networks — FortiManager should not be reachable from the internet without VPN + MFA. Implement jump host architecture for administrative access.
- Enable FortiManager administrative logging and forward to a SIEM with alerting on configuration export events, bulk reads, and new device enrollment.
- Hunt for IOC 23.240.77.233:8085 in network logs — this is the PEERSTITCH component download server identified by Unit 42.
Strategic Posture
Organizations must assume that compromise of a central management appliance constitutes full compromise of all managed devices. This means trust material rotation, configuration integrity verification, and independent monitoring of managed devices should be part of every incident response plan involving management infrastructure. The lesson from UNC5820 is clear: the management plane is the new perimeter, and treating it as anything less than critical infrastructure is an unacceptable risk.
