Search — “CVE-2024-26009”

Unit 42 describes CL-STA-0954 (UNC5820) exploiting FortiJump (CVE-2024-47575) on a telecom MSP's FortiManager, registering a rogue VM FortiGate and exfiltrating configs/keys for 500+ managed FortiGates. Using cracked credentials they opened SSL-VPN sessions, exploited CVE-2025-61624 auto-script path traversal to root, and deployed PEERSTITCH, a ptrace injector that patches miglogd and iked in memory, plus an Apache mod_md ACME reverse shell. Hunt for auto-script objects with ../ names, rogue FortiManager device registrations, FortiGateCloud admin config downloads, killall of miglogd/syslogd, crashlog clears, and RWX 16KB regions in miglogd/iked.

Unit 42 reports that CL-STA-0954 (aka UNC5820) breached a telecom MSP via FortiManager FortiJump (CVE-2024-47575). The actor stole configs, credentials and keys for 500+ managed FortiGates, then used them for unauthorized SSL/VPN sessions and exploited the FortiOS CLI path traversal CVE-2025-61624 (KEV-listed) to deploy PEERSTITCH. PEERSTITCH is an ARM64 injector delivered by an auto-script from 23.240.77[.]233:8085; it ptrace-injects into /bin/miglogd and /bin/iked to bypass validation on tagged VPN sessions. Hunters should look for unexpected FortiGate auto-scripts, rogue or short-lived admin accounts, syslog or crash-log gaps, Apache mod_md spawning SSH reverse shells, FortiManager-impersonating config pulls, and outbound fetches of the five component files.