Unit 42 published its investigation of a Sep 2024 telecom-MSP intrusion tracked as CL-STA-0954 (aka UNC5820). Initial access: unauthenticated CVE-2024-47575 (FortiJump) on FortiManager, registering a rogue Virtual FortiGate and exfiltrating an archive with running configs, crypto material, and DB files for more than 500 managed FortiGates (provider + clients). Follow-on: sniffers, credential recovery from reversible ciphertext, SSL/VPN re-entry, then CVE-2025-61624 (auto-script path traversal) to drop PEERSTITCH—an ARM64 memory-resident injector that ptrace-patches /bin/miglogd and /bin/iked, uses covert cross-PID /proc/.../mem IPC, and can bypass tagged VPN session checks. Separate C2 abused Apache mod_md ACME DNS-01 mapped to /bin/node. Trust material remains valid until rotated even after the management box is patched. See companion hunt item for IOCs and memory hunts.