Threat feed

PEERSTITCH pivot (pipeline test)

TEST: CL-STA-0954 pivots from a hacked FortiManager to managed FortiGates, injecting into log daemons

Posted · Spectrum Delta Research Team

Summary

CL-STA-0954 (aka UNC5820) turned one FortiManager into keys to 500+ FortiGates, then left a memory-only implant with no file, port or callback; downstream compromise is unconfirmed. Unit 42 (Oct 14, B/2) reported a September 2024 intrusion at a telecom managed service provider via CVE-2024-47575; CISA added CVE-2025-61624 to KEV on Oct 16, 2026 and flags it for forensic triage. Client networks were not examined; stolen trust material stays valid until rotated.

Breakdown

Industries

  • Telecommunications
  • Managed service providers

Adversary

CL-STA-0954 (aka UNC5820) · overlaps with suspected nation-state intrusions, no state attribution (Unit 42, B/2)

Procedures (7)

  1. Rogue FortiGate registered

    • T1190Exploit Public-Facing Application

    Logs

    • FortiManager event and audit · Device registration, archive creation, sniffer configuration pushes

    Detectors

    • Palo Alto Networks Advanced Threat Prevention · Threat Prevention signatures 95788, 96788 (CVE-2024-47575)
Click to expand remaining (6) procedures

  1. Config archive exfiltrated

    • T1005Data from Local System
    • T1041Exfiltration Over C2 Channel

    Logs

    • FortiManager event and audit · Device registration, archive creation, sniffer configuration pushes

    Detectors

    No known detector

  2. Sniffers pushed downstream

    • T1040Network Sniffing

    Logs

    • FortiManager event and audit · Device registration, archive creation, sniffer configuration pushes
    • FortiGate configuration and CLI audit · Config-change cfgpath auto-script, sniffer, admin; VPN group, killall, crashlog

    Detectors

    No known detector

  3. Stolen credentials reused

    • T1078Valid Accounts
    • T1133External Remote Services

    Logs

    • FortiGate VPN event · SSL-VPN tunnel-up (logid 0101039424) with remip and user
    • FortiGate configuration and CLI audit · Config-change cfgpath auto-script, sniffer, admin; VPN group, killall, crashlog

    Detectors

    No known detector

  4. Auto-script path traversal

    • T1068Exploitation for Privilege Escalation
    • T1105Ingress Tool Transfer

    Logs

    • FortiGate configuration and CLI audit · Config-change cfgpath auto-script, sniffer, admin; VPN group, killall, crashlog

    Detectors

    • Fortinet virtual patch (FMWP) · FG-VD-59270.0day (CVE-2025-61624)

  5. PEERSTITCH memory injection

    • T1055.008Process Injection: Ptrace System Calls
    • T1055.009Process Injection: Proc Memory

    Logs

    • FortiGate crashlog and system · Signal 11 in miglogd, iked or syslogd; syslog gaps

    Detectors

    No known detector

  6. Logs killed and cleared

    • T1685Disable or Modify Tools
    • T1070Indicator Removal

    Logs

    • FortiGate configuration and CLI audit · Config-change cfgpath auto-script, sniffer, admin; VPN group, killall, crashlog
    • FortiGate crashlog and system · Signal 11 in miglogd, iked or syslogd; syslog gaps

    Detectors

    No known detector

Indicators of compromise

IPs (11)

  • 45.32.41.202rogue-registration source, first
  • 198.199.122.22rogue-registration source, second
  • 23.240.77.233installer host, serves /pM.js on TCP 8085; rogue ACME server on 8084
  • 47.18.167.159installer host, serves /pM.js on TCP 8085
  • 104.238.141.143CVE-2024-47575 exploitation, Fortinet FG-IR-24-423; not tied to this incident
  • 158.247.199.37CVE-2024-47575 exploitation, Fortinet FG-IR-24-423; not tied to this incident
  • 45.32.63.2CVE-2024-47575 exploitation, Fortinet FG-IR-24-423; not tied to this incident
  • 80.66.196.199CVE-2024-47575 exploitation, Fortinet FG-IR-24-423; not tied to this incident
  • 142.93.177.233CVE-2024-47575 exploitation, Fortinet FG-IR-24-423; not tied to this incident
  • 195.85.114.78CVE-2024-47575 exploitation (Mandiant), Fortinet FG-IR-24-423
  • 172.232.167.68CVE-2024-47575 exploitation (third party), Fortinet FG-IR-24-423

URLs (7)

  • 23.240.77.233:8084/directoryrogue ACME server
  • 23.240.77.233:8084/acme/new-acctrogue ACME server
  • 23.240.77.233:8084/acme/order/11111rogue ACME server
  • 23.240.77.233:8084/acme/authz/1rogue ACME server
  • 23.240.77.233:8084/acme/finalize/61924744/774083503rogue ACME server
  • 23.240.77.233:8085/pM.jsinstaller host
  • 47.18.167.159:8085/pM.jsinstaller host

Hashes (7)

  • b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70SHA-256, lldprx injector
  • 829b1cd270b30565739a478441833f49f10a49bd06f0d18cc96c8ae4a0431f11SHA-256, mmap shellcode bootstrap header
  • bd064244dad748cf2a44074bee56f5bfab4a2b18ee944b75d1b3febd4c1fe02aSHA-256, hook injection data block
  • 9c4c4436ff5cdf0d6d68f5108031cbf3708a095cde4ef8c09316af7a7110437eSHA-256, pM.js staging script
  • fc1b10c58057ef9f1f9a1e2a3d4a1c89f43b0ead451398c70ed7a6e0312b36eeSHA-256, ipssem.js orchestrator
  • f84eea718526706afdf2d1a2774fab76ecb11c18fb61995a37be8249c5e379abSHA-256, index.js
  • b7ae166fd49a7ecfe6322a80b8aa56d6aa0825d8f5d106dab2e4fb7d14ce15a8SHA-256, index.wasm

CVEs (2)

  • CVE-2024-47575FortiManager fgfmsd missing authentication
  • CVE-2025-61624FortiOS CLI path traversal, auto-script

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of PEERSTITCH pivot (pipeline test)? Bring them to the community.

Discuss in the Tradecraft Slack