Telecom Provider Breached Through FortiManager, Exposing Configuration Data for 500+ Firewalls

Palo Alto Networks' Unit 42 has described a multi-stage intrusion against a telecommunications managed service provider in September 2024. The activity is tracked as CL-STA-0954 (also known as UNC5820). The attackers gained initial access by exploiting CVE-2024-47575 on a centralised FortiManager appliance. From that single device, Unit 42 observed them exfiltrating an archive containing running configurations, cryptographic material and database files covering more than 500 managed FortiGate firewalls. Those firewalls protected the provider's own infrastructure and its clients' networks.

The attackers then exploited a second vulnerability, CVE-2025-61624, through a FortiOS auto-script path traversal. This allowed them to deploy PEERSTITCH, a new memory-resident ARM64 malware. According to Unit 42, it leaves no persistent file on disk, opens no listening ports and makes no outbound connections of its own. It communicates through traffic generated by legitimate processes on the infected device, which makes it resistant to conventional endpoint and network detection. The attackers also impersonated FortiManager to pull data from other managed firewalls. Unit 42 says the tradecraft showed deep knowledge of Fortinet architecture and overlaps with suspected nation-state activity.

Unit 42 examined only the provider's own environment, not client networks. The exposure for clients is of configuration and credential material, not confirmed intrusion. This summary draws on the opening of the report only.