Key facts
- UNC5820 exploited the Fortinet path traversal vulnerability CVE-2025-61624, a zero‑day disclosed in April 2026, to obtain root access on FortiGate appliances and deploy the PeerStitch backdoor.
- According to Palo Alto Networks, a suspected state-sponsored threat actor used several Fortinet flaws to breach a telecommunications organization.
- After the FortiManager patches were issued, Mandiant alerted that UNC5820 had been using the FortiJump vulnerability from June 2024 onward.
- CVE-2025-61624 lets authenticated attackers write or delete files on the system; Fortinet labeled the active use of this flaw as a zero-day when it was disclosed; the flaw was patched in April 2026.
UNC5820 exploited the FortiManager remote code execution vulnerability CVE-2024-47575 to gain initial access to a telecommunications provider’s network in September 2024, with Mandiant noting exploitation since at least June 2024. Fortinet issued a security update for CVE-2024-47575 in October 2024, classifying the flaw as a zero‑day at the time of release.
After the patch, Mandiant alerted that UNC5820 had been abusing the FortiJump vulnerability from June 2024 onward. The attackers then exploited the Fortinet path‑traversal vulnerability CVE-2025-61624, a zero‑day disclosed in April 2026, to obtain root access on FortiGate appliances and deploy the PeerStitch backdoor.
CVE-2025-61624 lets authenticated attackers write or delete files on the system; Fortinet labeled its active exploitation as a zero‑day when disclosed and patched it in April 2026. Using this flaw, UNC5820 obtained root privileges on the FortiGate OS and placed a launch script for the previously unknown implant later named PeerStitch.
The PeerStitch implant is an ARM64‑resident malware program written in C that resides solely in memory, does not open listening ports or initiate outbound connections, and hides its communication by piggybacking on legitimate processes inside the FortiGate appliance. To maintain covert command and control, UNC5820 impersonated the legitimate FortiManager in FGFM communications—either by terminating the authentic session via CVE-2024-26008 or by reusing exfiltrated credentials—to send commands from outside systems and deliberately cleared logs and other forensic artifacts.
With control of the central FortiManager, the threat actor registered a rogue virtual FortiGate appliance and exfiltrated a configuration archive containing details about the FortiManager itself, information on more than five hundred managed FortiGate firewalls, and a map of the victim’s internal network topology. During the attack, UNC5820 exploited the FortiJump vulnerability to gain access to the central FortiManager instance.
The intrusion attributed to UNC5820 occurred in September 2024 and resulted in long‑term, undetected access to the telecommunications provider’s environment. According to Palo Alto Networks, a suspected state‑sponsored threat actor used several Fortinet flaws to breach a telecommunications organization. Palo Alto Networks said the PeerStitch implant shows growing technical maturity of edge‑device malware.
On Friday, CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities list, urging federal agencies to patch it immediately. Network operators should apply patches for CVE-2024-47575 and CVE-2025-61624, monitor FGFM channels for impostor FortiManager sessions, and watch for rogue virtual FortiGate appliances and anomalous archive account configurations.
Join the discussion