Unit 42 describes a September 2024 intrusion at a managed telecom services provider that began with FortiManager’s FortiJump flaw (CVE-2024-47575).
Attackers obtained data on more than 500 managed FortiGate firewalls, then used a separate flaw, CVE-2025-61624, to install PEERSTITCH.
The report details how the memory-resident program alters FortiOS handling of certain VPN connections; Fortinet fixed CVE-2025-61624 in April 2026.
How the invasion began
The breach took place in September 2024. Initially, the attackers gained access by exploiting a security vulnerability in the FortiManager appliance. After the breach, they obtained a file containing information about more than 500 firewalls managed by the provider.
The file included device settings, management data, serial numbers, public addresses, network maps, login details, as well as digital certificates and private keys. According to the researchers, the attackers used this data to explore networks, monitor traffic, maintain access, and connect without permission to firewalls.
The PEERSTITCH program
To install PEERSTITCH, the attackers exploited a separate issue affecting several Fortinet products. This vulnerability allowed an elevated user to delete or write files via special commands. Fortinet released an update for the issue in April 2026.
READ ALSO
How dangerous ads infect devices without the user doing anything
PEERSTITCH does not leave permanent files on the device's disk and does not initiate its own external connections. Instead, it uses the traffic of legitimate system functions to communicate, which makes it more inconspicuous. In addition, it modifies the handling of specific connections, bypassing standard security checks.
Hiding traces
The attackers also created a separate way of remote access, exploiting a feature that already existed on the devices. To avoid detection, they stopped logging activity, cleaned error logs, and set up automatic deletion of accounts and commands they had added to the system.
Unit 42 is investigating the case under the codename CL-STA-0954, also known as UNC5820. Investigators say the suspect is being treated as a suspect, as his identity has not been confirmed.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)