Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Telecommunications Managed Service Provider
Incident: Exploitation of Fortinet vulnerabilities to deploy stealthy PEERSTITCH malware across managed infrastructure.
Impact: Unauthorized access to 500+ firewalls, theft of cryptographic material, and long-term network persistence.
Attacker: UNC5820 (CL-STA-0954)
Analysis: The threat actor utilized a multi-stage attack starting with the FortiJump vulnerability to compromise a FortiManager appliance. By stealing configurations for over 500 firewalls, the attackers pivoted into downstream networks and deployed the PEERSTITCH implant. This malware is particularly dangerous because it operates solely in memory and hides its communication within legitimate system processes to evade network monitoring.
Recommendations: Immediately patch FortiOS and FortiManager to resolve CVE-2024-47575 and CVE-2025-61624.; Audit SSL/VPN session logs for unauthorized or anomalous access patterns.; Implement strict access controls and enhanced monitoring for centralized management appliances.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source