Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
A suspected state-sponsored threat actor exploited multiple Fortinet vulnerabilities in an attack against a telecommunications organization, Palo Alto Networks reports.
The intrusion, attributed to UNC5820 (tracked by Palo Alto Networks as CL-STA-0954), occurred in September 2024 and resulted in long-term access to the victim’s environment.
Initial access was obtained through the exploitation of a critical remote code execution (RCE) bug in FortiManager, tracked as CVE-2024-47575 and patched in October 2024 as a zero-day.
Shortly after the patches were rolled out, Mandiant warned that UNC5820 had been exploiting the flaw, named FortiJump, since at least June 2024.
A fresh report from Palo Alto Networks shows that UNC5820 also exploited CVE-2025-61624, a path traversal vulnerability affecting multiple Fortinet products, as part of the same intrusion.
Impacting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager and patched in April 2026, the security defect could allow authenticated attackers to write or delete arbitrary files. Fortinet flagged...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
