One compromised management appliance handed attackers the keys to hundreds of networks. Palo Alto Networks Unit 42 has detailed a multi-stage intrusion against a telecommunications provider that it tracks as CL-STA-0954, also known as UNC5820.
The entry point was CVE-2024-47575, the FortiManager flaw known as FortiJump. It let an unauthenticated attacker register a rogue virtual device with the central management platform. Within minutes, the intruders pulled a configuration archive covering more than 500 managed FortiGate firewalls.
What leaked in that archive
Serial numbers, public IP addresses, routing tables, VPN credentials and cryptographic trust material. The affected firewalls did not all belong to the same victim, Unit 42 notes – they protected the provider’s own infrastructure plus its clients’ networks.
To stay resident, the crew chained a second bug, CVE-2025-61624, a FortiOS auto-script path traversal, to plant PEERSTITCH. The implant is a memory-resident ARM64 payload.
PEERSTITCH leaves no binary on disk, opens no listening ports and makes no outbound connections. It rides traffic from legitimate processes, which is why conventional detection misses it.
The lesson for managed providers
Centralized management is a single point of failure with enormous blast radius. Unit 42’s review covered only the provider’s own environment, not downstream clients – so the true exposure may still be uncounted.
Patch FortiManager, rotate every credential and certificate stored there, and assume configurations and keys were copied.
