---
title: Unit 42: CL-STA-0954/UNC5820 stole 500+ FortiGate configs via FortiManager CVE-2024-47575, then deployed memory-only PEERSTITCH via CVE-2025-61624 | ctxsec
url: https://ctxsec.com/items/unit42-peerstitch-fortios
description: ""
status: "confirmed (Unit 42)"
published: 2026-10-15
---

> 

[← Cybersecurity News](/news) · [markdown](/items/unit42-peerstitch-fortios.md)

confirmed (Unit 42)

2026-10-15

### Unit 42: CL-STA-0954/UNC5820 stole 500+ FortiGate configs via FortiManager CVE-2024-47575, then deployed memory-only PEERSTITCH via CVE-2025-61624

Unit 42 published its investigation of a Sep 2024 telecom-MSP intrusion tracked as CL-STA-0954 (aka UNC5820). Initial access: unauthenticated CVE-2024-47575 (FortiJump) on FortiManager, registering a rogue Virtual FortiGate and exfiltrating an archive with running configs, crypto material, and DB files for more than 500 managed FortiGates (provider + clients). Follow-on: sniffers, credential recovery from reversible ciphertext, SSL/VPN re-entry, then CVE-2025-61624 (auto-script path traversal) to drop PEERSTITCH—an ARM64 memory-resident injector that ptrace-patches `/bin/miglogd` and `/bin/iked`, uses covert cross-PID `/proc/.../mem` IPC, and can bypass tagged VPN session checks. Separate C2 abused Apache mod_md ACME DNS-01 mapped to `/bin/node`. Trust material remains valid until rotated even after the management box is patched. See companion hunt item for IOCs and memory hunts.

Sources: [Unit 42: PEERSTITCH FortiGate implant](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/) · [Unit 42 on X](https://x.com/Unit42_Intel/status/2110822781017285090)