Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack

UNC5820, a suspected state-sponsored threat actor, exploited multiple Fortinet vulnerabilities — including two zero-days — to establish long-term, covert access inside a telecommunications organization. The deployment of PeerStitch, a memory-resident implant that mimics legitimate network traffic, demonstrates how advanced adversaries leverage unpatched edge devices to maintain persistent, nearly invisible footholds. Telecommunications infrastructure is high-value critical infrastructure, making it a prime target for espionage-motivated actors who prioritize stealth over speed. The combination of zero-day exploitation and memory-only malware underscores the critical importance of rapid vulnerability response, robust network monitoring, and behavioral detection capabilities that go beyond signature-based tools.