Recent reports issued by cybersecurity companies showed that a state-sponsored cyber threat group (known as UNC5820 or CL-STA-0954) successfully launched complex attacks targeting an organization specialized in the telecommunications sector during September 2024, maintaining access to the victim's environment for a prolonged period.
During the initial access phase, the attackers relied on exploiting a critical remote code execution vulnerability in the FortiManager system tracked as CVE-2024-47575, known as the FortiJump vulnerability, which was patched in October 2024 as a zero-day vulnerability. The attack also included exploiting another path traversal vulnerability bearing the code CVE-2025-61624, which affects several Fortinet products, allowing the attackers to write or delete arbitrary files and gain root privileges on the firewall's operating system.
Deployment of the PeerStitch Malware
The exploitation of Fortinet vulnerabilities led to the deployment of a new and unprecedented malware implant named PeerStitch on FortiGate devices. Designed for ARM64 processors, this malware resides entirely in random-access memory (RAM) and completely avoids opening listening ports or initiating outbound network connections, relying instead on passing communications through traffic generated by legitimate processes on the targeted device.
The attacking group registered an unlicensed FortiGate virtual machine and extracted an archive containing the victim's network details and over 500 managed firewalls. Subsequently, the PeerStitch malware acted as a one-time process memory patching injector, targeting the central daemon, traffic, and VPN network services to establish a covert in-memory communication bridge that bypasses default security validation rules.
Why Does This News Matter?
This attack represents a qualitative leap in the complexity level of malware directed against edge devices and sensitive telecommunications networks. By operating exclusively within memory and avoiding leaving any traces on hard drives, the attackers managed to achieve long-term persistence while evading traditional security monitoring tools, compelling organizations to update their edge-facing systems and continuously verify security logs.