Palo Alto Networks links telecom hack to PeerStitch implant on FortiGate

UNC5820 (CL-STA-0954) breached a telecom operator in September 2024 by exploiting Fortinet flaws CVE-2024-47575 (FortiJump) and CVE-2025-61624, gaining root access and deploying a previously unknown implant called PeerStitch. The ARM64 malware lives in memory, opens no ports and blends into traffic from legitimate processes. CISA added CVE-2025-61624 to its KEV list.

• The attack touched over 500 managed FortiGate firewalls and a central FortiManager
• CVE-2025-61624 was patched in April 2026 and exploited as a zero-day
• PeerStitch is written in C and acts as a one-shot memory patching injector
• CISA added CVE-2025-61624 to KEV and urges immediate patching