Patching FortiManager closed the hole the intruders entered through, but it did not remove what they left behind. Palo Alto Networks has published analysis of a telecommunications intrusion where a group known as UNC5820 kept running for months inside the network.
The entry point was a critical remote code execution bug in FortiManager, catalogued as CVE-2024-47575 and patched in October 2024 as a zero-day. Mandiant warned shortly after that rollout that the same actor had already used the flaw to escape detection elsewhere, and this event fits that pattern.
What Palo Alto Networks tracked, under its designation CL-STA-0954, was the persistence layer. The implant is called PeerStitch, and the unit describes it as persistent and stealthy, sitting on FortiGate appliances rather than on ordinary servers.
The notable technique is that it operates on VPN sessions carrying tags. Traffic that the gateway has already classified and labelled receives less scrutiny than traffic arriving cold, and PeerStitch inserted itself into that trusted path. The resulting access belonged to no user account, so credential resets and MFA changes did nothing to displace it.
The intrusion is dated to September 2024, meaning the dwell time is measured in months rather than days.
Teams with Fortinet estates should treat an October 2024 FortiManager patch as the start of the work, not the end. Sweep appliances for unexpected implant artefacts, compare device configuration against gold images, and audit for management accounts and VPN sessions that engineers cannot attribute to a person.
Source: SecurityWeek
