Telecom Hackers Stole Data on 500 Firewalls and Left a Hidden Implant Behind
A suspected nation-state group broke into a single Fortinet device, walked out with the keys to hundreds of firewalls, then planted malware that hides inside the device's own memory. Here's what happened.
Key points
- Palo Alto Networks tracked a September 2024 intrusion against an unnamed telecommunications company, attributed to a cluster the firm calls CL-STA-0954, also identified by Mandiant as UNC5820.
- The attackers exploited CVE-2024-47575, a critical flaw in Fortinet's FortiManager network-management software, to steal configuration files covering more than 500 managed firewalls.
- A second vulnerability, CVE-2025-61624, was used as a zero-day to deploy a previously unknown memory-resident implant called PeerStitch.
- CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities list on a Friday, urging federal agencies to patch it immediately.
- Palo Alto Networks says post-exploitation tradecraft overlaps with methods seen in previous suspected nation-state intrusions, though the group's country of origin has not been confirmed publicly.
One appliance was all it took. The attackers hit a FortiManager device, the central console administrators use to manage large numbers of Fortinet firewalls from a single place, by exploiting CVE-2024-47575, a missing-authentication flaw that let them reach the console without a password. Fortinet patched it in October 2024 after it was already being used in the wild. Mandiant later warned that UNC5820 had been exploiting the flaw since at least June 2024.
From that foothold, the attackers pulled an archive containing configuration data and database files describing the FortiManager itself, more than 500 managed FortiGate firewalls, and the victim's wider network. Those firewalls protected both the telecom company's own infrastructure and its business customers.
We first covered CVE-2025-61624 on 16 October 2026 in "Hackers used a Fortinet firewall flaw to steal secrets on 500-plus networks", when CISA added it to the mandatory patch list. Palo Alto Networks' fresh report is the first to connect the implant to this specific September 2024 intrusion.
How did they stay hidden for so long?
Once inside, the attackers moved carefully. They registered a fake virtual FortiGate device on the FortiManager console, blending into normal management traffic. Then they exploited CVE-2025-61624, a path traversal vulnerability, meaning a flaw that lets a user reach files outside the folders they're supposed to access, to gain root-level control of the firewall's underlying operating system.
With root access established, they deployed PeerStitch. Written in C and compiled for the ARM64 architecture, the implant lives entirely in memory, leaving nothing on storage for forensic tools to find. It doesn't open its own network connection or listen on a port. Instead it patches itself into the processes handling VPN sessions and traffic logs, creating a hidden communication bridge between those legitimate processes so that commands arrive disguised as ordinary firewall traffic.
| Vulnerability | Affected product | CVSS score | Patch available | CISA deadline |
|---|---|---|---|---|
| CVE-2024-47575 | FortiManager (multiple versions) | 9.8 Critical | October 2024 | November 13, 2024 |
| CVE-2025-61624 | FortiOS, FortiPAM, FortiProxy, FortiSwitchManager | Not listed in source | April 2026 | Added to KEV; patch urged immediately |
| CVE-2024-26008 | FortiOS, FortiProxy, FortiPAM, FortiSwitchManager | Not listed in source | See NVD | Not listed |
The group also exploited CVE-2024-26008 to impersonate the legitimate FortiManager and issue commands from external infrastructure, either by terminating the real FortiManager's session or by reusing exfiltrated credentials. Palo Alto Networks says the attackers "took extensive measures to eliminate forensic artifacts" throughout.
Should telecom customers be concerned?
The stolen archive described the internal network layout of the telecom's own clients. Anyone whose connectivity ran through that provider during or after September 2024 should treat their network topology as potentially exposed.
If you run Fortinet equipment, check whether your devices fall within the affected version ranges in the CVE records above and prioritise patching both vulnerabilities.
The PeerStitch implant is what makes this campaign worth watching beyond the victim count. Memory-only malware on a network edge device is genuinely hard to detect with standard monitoring, and this is the first public documentation of the technique against FortiOS. Attribution to a specific country sits at medium confidence at best given the single primary source, but the tradecraft overlap with prior suspected nation-state clusters isn't trivial. Watch whether other telecom providers disclose similar intrusions in the coming weeks.
