Check Fortinet Devices for PeerStitch Implant After Telecom Breach

Telecommunications organisations using Fortinet security appliances are the primary focus of this report, as a state-sponsored threat actor known as UNC5820 has been linked to a significant intrusion involving their infrastructure. According to Palo Alto Networks, the group targeted a telecom entity in September 2024, gaining long-term access to its environment. The breach involved the theft of sensitive configuration data and the deployment of a stealthy implant designed to evade standard detection methods, raising concerns for any customer relying on these network security tools.

Which specific vulnerabilities were exploited?

The intrusion relied on two distinct security flaws in Fortinet products. Initial access was achieved through CVE-2024-47575, a critical remote code execution bug in FortiManager that was patched in October 2024 after being used as a zero-day. Palo Alto Networks reports that the attackers also exploited CVE-2025-61624, a path traversal vulnerability affecting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. This second flaw, patched in April 2026, allows authenticated users to write or delete arbitrary files and was added to the US CISA Known Exploited Vulnerabilities list.

What data and systems were compromised?

The attackers used the FortiJump exploit to reach a central FortiManager instance and register a rogue Virtual FortiGate appliance. They then exfiltrated a configuration archive containing details for the FortiManager itself and more than 500 managed FortiGate firewalls, along with the victim’s network information. Following this data theft, the group used the path traversal flaw to gain root access to the underlying firewall operating system. This elevated privilege allowed them to drop a script that initiated the deployment of their custom malware, effectively securing a foothold deep within the network infrastructure.

How does the PeerStitch implant operate?

The malware, dubbed PeerStitch, is an ARM64 implant written in C that resides entirely in memory. It avoids opening listening ports or initiating outbound network connections, which makes it difficult to detect through standard network monitoring. Instead, it communicates through traffic generated by legitimate processes on the appliance. The implant acts as a memory patching injector, targeting central system logging and IKE/IPsec VPN service daemons in FortiOS to create a covert communication bridge that bypasses default security validations, according to Palo Alto Networks.

What is the current status of the threat?

Mandiant warned that UNC5820 had been exploiting the initial FortiManager flaw since at least June 2024, months before the public patch. The US cybersecurity agency CISA has since added the path traversal vulnerability to its KEV list, urging federal agencies to patch immediately. While the specific telecom victim is identified only as an organization, the use of these vulnerabilities suggests that other entities running unpatched versions of FortiManager, FortiOS, or related products may also be at risk from this persistent threat actor.

What affected people can do

Organisations should verify that all Fortinet devices are running the latest software versions to mitigate known path traversal and remote execution risks. Security teams usually review access logs for unusual administrative actions, such as the registration of unexpected virtual appliances or changes to central management configurations.

Users should monitor for anomalous process behaviour that does not correlate with normal network traffic patterns. Recognising follow-up scams is vital; attackers often use breach news to trick users into clicking malicious links. Always verify urgent requests through established channels and avoid downloading files from unsolicited emails claiming to offer emergency patches.

What to do and how to stay safe

• Ensure all Fortinet products, including FortiManager and FortiOS, are updated to the latest patched versions available from the vendor.
• Review system logs for signs of unauthorised administrative access or the creation of rogue virtual

Step-by-step guide: Is It Safe to Use Password Managers? The Real Risks and Rewards

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.