Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack

In September 2024, the threat actor UNC5820 exploited a critical remote code execution vulnerability in FortiManager (CVE-2024-47575) to gain initial access to a telecommunications organization's environment. Subsequently, UNC5820 exploited CVE-2025-61624, a path traversal vulnerability affecting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, to gain root access and deploy the PeerStitch implant. PeerStitch is an ARM64 memory-resident implant that avoids persistent disk artifacts, does not open listening ports or initiate outbound connections, and communicates covertly through legitimate process traffic. The implant patches process memory to create a covert communication bridge between system components, bypassing FortiOS security validations. The attacker also impersonated FortiManager in communications and took measures to erase forensic evidence. Both vulnerabilities have been patched by Fortinet, with CVE-2024-47575 patched in October 2024 and CVE-2025-61624 patched in April 2026. CISA has added CVE-2025-61624 to its KEV list, recommending immediate patching.

The exploitation allowed the attacker to gain persistent, stealthy root-level access to the victim's Fortinet infrastructure, including FortiManager and over 500 managed FortiGate firewalls. This enabled exfiltration of sensitive configuration data and covert control over network security devices. The implant's memory-resident nature and covert communication methods allowed evasion of traditional detection and forensic analysis, resulting in long-term undetected access and control over critical telecommunications infrastructure.

Both vulnerabilities exploited in this attack have official patches available: CVE-2024-47575 was patched in October 2024, and CVE-2025-61624 was patched in April 2026. Organizations should apply these patches immediately. The US CISA has added CVE-2025-61624 to its Known Exploited Vulnerabilities list and urges federal agencies and others to patch without delay. No additional mitigation actions are specified beyond applying these official fixes.