UNC5820 used Fortinet zero-days CVE-2024-47575 and CVE-2025-61624 to plant PeerStitch malware on a telecom FortiGate

Updated: 2026.10.19 1D ago 1 sources

Zero-Days & CVEs Threat Actors & APTs Malware

A suspected state-backed hacker broke into a telecommunications organization through Fortinet management and firewall systems and planted a stealthy malware implant on a FortiGate device. Palo Alto Networks says UNC5820 first exploited FortiManager remote-code-execution flaw CVE-2024-47575 ('FortiJump') in 2024, then used CVE-2025-61624, a path traversal flaw in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, to gain root access and deploy the memory-resident PeerStitch implant while hiding forensic evidence.

Why it matters: This shows attackers are using Fortinet edge devices for long-term covert access inside real telecom networks, not just one-off break-ins. Organizations using affected Fortinet products should urgently patch, review FortiManager and FortiGate logs and registrations for rogue devices, and hunt for signs of unauthorized FGFM and VPN daemon manipulation.

Sources

Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack

Ionut Arghire 2026.10.19 100% relevant

The article establishes a distinct intrusion story centered on UNC5820, a telecom victim, and the previously unknown PeerStitch FortiGate implant deployed via CVE-2024-47575 and CVE-2025-61624.