Palo Alto Networks Unit 42 disclosed PEERSTITCH, a previously unreported memory-resident ARM64 implant deployed against a telecommunications managed service provider in a multi-stage intrusion tracked as CL-STA-0954 (also UNC5820). Initial access came from exploitation of CVE-2024-47575 against a centralised FortiManager appliance; the attackers then exfiltrated an archive containing running configurations, cryptographic material and database files covering more than 500 managed FortiGate firewalls that protected the target's own infrastructure and its clients' networks, and used that intelligence to maintain long-term access, intercept network traffic and establish VPN sessions. PEERSTITCH deployment used a second flaw, CVE-2025-61624 — a path-traversal in the FortiOS command-line interpreter affecting FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, patched in April 2026 — and the implant leaves no persistent binary on disk, opens no listening ports and initiates no outbound connections, communicating inside traffic generated by legitimate processes. That makes it resistant to conventional endpoint and network detection, and CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalogue on 16 October.

• Source article