Threat Actor Unknown origin

UNC5820

UNC5820 is a threat actor exploiting the CVE-2024-47575 vulnerability in Fortinet's FortiManager, allowing them to bypass authentication and execute arbitrary commands. They have been observed exfiltrating configuration data, user information, and FortiOS256-hashed passwords from managed FortiGate devices. While the actor has staged and exfiltrated sensitive data, there is currently no evidence of lateral movement or further compromise of additional environments. Mandiant has not determined whether UNC5820 is state-sponsored or identified its geographic location.

Indicators of Compromise 20

Domain 23[.]240[.]77[.]233 Domain 47[.]18[.]167[.]159 Filename ../../../../setup Filename ../../tmp/apache2/conf/md-acme.conf Filename index.wasm Filename ipssem.js Filename lldprx Filename pM.js SHA-256 829b1cd270b30565739a478441833f49f10a49bd06f0d18cc96c8ae4a0431f11 SHA-256 8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92 SHA-256 9c4c4436ff5cdf0d6d68f5108031cbf3708a095cde4ef8c09316af7a7110437e SHA-256 b7ae166fd49a7ecfe6322a80b8aa56d6aa0825d8f5d106dab2e4fb7d14ce15a8 SHA-256 b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70 SHA-256 bd064244dad748cf2a44074bee56f5bfab4a2b18ee944b75d1b3febd4c1fe02a SHA-256 f84eea718526706afdf2d1a2774fab76ecb11c18fb61995a37be8249c5e379ab SHA-256 fc1b10c58057ef9f1f9a1e2a3d4a1c89f43b0ead451398c70ed7a6e0312b36ee IP 198[.]199[.]122[.]22 IP 23[.]240[.]77[.]233 IP 45[.]32[.]41[.]202 IP 47[.]18[.]167[.]159

MITRE ATT&CK TTPs 17

T1055
Process Injection
Defense Evasion
 T1055.005
Thread Local Storage
Defense Evasion
 T1070.004
File Deletion
Defense Evasion
 T1070.006
Timestomp
Defense Evasion
 T1134
Access Token Manipulation
Defense Evasion
 T1548
Abuse Elevation Control Mechanism
Privilege Escalation
 T1548.001
Setuid and Setgid
Privilege Escalation
 T1552
Unsecured Credentials
Credential Access
 T1552.001
Credentials In Files
Credential Access
 T1566
Phishing
Initial Access
 T1566.001
Spearphishing Attachment
Initial Access
 T1571
Non-Standard Port
Command And Control
 T1572
Protocol Tunneling
Command And Control
 T1574
Hijack Execution Flow
Persistence
 T1574.002
DLL Side-Loading
Persistence
 T1588
Obtain Capabilities
Resource Development
 T1588.001
Malware
Resource Development

Source Articles

Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
Unit 42 uncovered a sophisticated network intrusion campaign tracked as CL-STA-0954, targeting a telecommunications organization via exploitation of CVE-2024-47575 (FortiJump) on a FortiManager appliance. Attackers exfiltrated configuration data, credentials, and cryptographic material for over 500 managed FortiGate firewalls. They later exploited CVE-2025-61624 to deploy PEERSTITCH, a novel memory-resident ARM64 malware that evades detection by patching running processes and establishing covert inter-process communication. The implant enables traffic interception, backdoor access, and privilege escalation without writing to disk or opening network ports.
unit42 ·3d ago