Executive Summary
Unit 42 identified a sophisticated intrusion campaign by threat actor cluster CL-STA-0954 (also known as UNC5820) targeting telecommunications managed service providers. The attackers initially gained access via CVE-2024-47575 (FortiJump) on a central FortiManager appliance, allowing them to exfiltrate configuration archives and cryptographic material for over 500 managed firewalls. This stolen data enabled long-term persistence, unauthorized VPN sessions, and lateral movement.
Technical analysis revealed the deployment of PEERSTITCH, a highly advanced memory-resident ARM64 malware that targets core FortiOS daemons (miglogd and iked). PEERSTITCH is notable for its stealth; it leaves no persistent binary on disk, opens no listening ports, and uses an inter-process communication bridge within memory to bypass security validations. The attackers also weaponized the Apache mod_md module via the ACME protocol to establish persistent SSH-based reverse shells.
This activity represents a critical risk to organizations using centralized edge management platforms. By compromising the central manager, the actor gained total visibility into internal network topologies and credential material for downstream clients. The use of memory-only implants and management platform impersonation demonstrates a high level of technical maturity and a focus on long-term, undetectable espionage.