Palo Alto Networks ties Fortinet zero-days to memory-only FortiGate implant in telecom intrusion
A suspected state-sponsored group used a FortiManager flaw for initial access, then a path traversal bug to gain root and deploy the PeerStitch implant, researchers say.
A suspected state-sponsored threat actor exploited multiple Fortinet vulnerabilities in an intrusion at a telecommunications organization, according to a Palo Alto Networks report described by SecurityWeek. The activity is attributed to UNC5820, which Palo Alto tracks as CL-STA-0954. The intrusion took place in September 2024 and gave the attackers long-term access, the report says.
Palo Alto says initial access came through a critical remote code execution flaw in FortiManager, patched in October 2024 as a zero-day. Mandiant had earlier warned that UNC5820 was exploiting that flaw, known as FortiJump, since at least June 2024.
The newer finding is that the same actor also exploited a path traversal vulnerability affecting FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, which Fortinet flagged as exploited as a zero-day when it disclosed the issue. Palo Alto says the actor used it to gain root on the firewall operating system and drop a script that deployed a previously unknown FortiGate implant, PeerStitch.
According to the report, PeerStitch is ARM64 malware that lives in memory, opens no listening ports and makes no outbound connections, instead communicating through traffic from legitimate processes. Palo Alto describes it as a one-shot process memory patching injector that targets system and traffic logging and the IKE/IPsec VPN service daemons.
The actor also registered a rogue virtual FortiGate and exfiltrated a configuration archive covering the FortiManager, more than 500 managed FortiGate firewalls and the victim's network, and impersonated FortiManager in firewall-to-manager communications, the report says.
CISA added the path traversal flaw to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch it.
For defenders, the report points to two lessons: edge appliances need monitoring that does not rely on disk artifacts or network connections, and management-plane credentials and trust relationships deserve scrutiny after any suspected compromise.
CVE references
Sources
- Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack - SecurityWeekPrimarywww.securityweek.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning