Search — “CL-STA-0954”

Unit 42 describes CL-STA-0954 (UNC5820) exploiting FortiJump (CVE-2024-47575) on a telecom MSP's FortiManager, registering a rogue VM FortiGate and exfiltrating configs/keys for 500+ managed FortiGates. Using cracked credentials they opened SSL-VPN sessions, exploited CVE-2025-61624 auto-script path traversal to root, and deployed PEERSTITCH, a ptrace injector that patches miglogd and iked in memory, plus an Apache mod_md ACME reverse shell. Hunt for auto-script objects with ../ names, rogue FortiManager device registrations, FortiGateCloud admin config downloads, killall of miglogd/syslogd, crashlog clears, and RWX 16KB regions in miglogd/iked.

Unit 42 reports that CL-STA-0954 (aka UNC5820) breached a telecom MSP via FortiManager FortiJump (CVE-2024-47575). The actor stole configs, credentials and keys for 500+ managed FortiGates, then used them for unauthorized SSL/VPN sessions and exploited the FortiOS CLI path traversal CVE-2025-61624 (KEV-listed) to deploy PEERSTITCH. PEERSTITCH is an ARM64 injector delivered by an auto-script from 23.240.77[.]233:8085; it ptrace-injects into /bin/miglogd and /bin/iked to bypass validation on tagged VPN sessions. Hunters should look for unexpected FortiGate auto-scripts, rogue or short-lived admin accounts, syslog or crash-log gaps, Apache mod_md spawning SSH reverse shells, FortiManager-impersonating config pulls, and outbound fetches of the five component files.

Per the brief, a suspected state actor (UNC5820/CL-STA-0954) chained FortiJump (CVE-2024-47575, also cited as CVE-2024-26008) for initial access and CVE-2025-61624 for root access against a telecom's FortiManager. The actor then pushed the PeerStitch implant to more than 500 managed FortiGate firewalls. The only linked source returned unrelated page content, so none of these details are corroborated. Hunters should look for rogue Virtual FortiGate registrations on FortiManager, unexpected configuration or firmware pushes to managed devices, and FortiManager processes gaining root access.