UNC5820Threat actor
UNC5820 is a threat actor exploiting the CVE-2024-47575 vulnerability in Fortinet's FortiManager, allowing them to bypass authentication and execute arbitrary commands. They have been observed exfiltrating configuration data, user information, and FortiOS256-hashed passwords from managed FortiGate devices.From MISP Galaxy
Last reported 5 days ago, by SecurityWeek5 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1552.004Private Keys
“The attackers got running configurations and private keys for firewalls belonging to organizations that had no idea any of this was happening.”
- T1003.007Proc Filesystem
“…in data and a link-local IP address, it extracts a session token and writes it directly into the VPN daemon’s memory using Linux’s /proc filesystem.”
- T1027.018Invisible Unicode
“Invisible Unicode characters: With the rise of AI email assistants, threat actors are going back to their bag of tricks from the early 2000s and we're seeing a rise in attacks leveraging invisible Unicode characters.”
- T1098.005Device Registration
“Immediately following device registration, the attacker generated a configuration archive named .tm in the FortiManager file system, which they exfiltrated shortly thereafter.”
- T1218.002Control Panel
“Control panel”
- T1505.003Web Shell
“The zero-day has been used to plant web shells on Nextcloud servers where the app was installed since at least September.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack“The intrusion, attributed to UNC5820 (tracked by Palo Alto Networks as CL-STA-0954), occurred in September 2024 and resulted in long-term access to the victim’s environment.”
-
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager“… intrusion against a telecommunications organization that occurred in September 2024, which we are tracking as cluster CL-STA-0954 (aka UNC5820).”
-
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions“The multi-stage network intrusion is being tracked as CL-STA-0954 (aka UNC5820), with initial access obtained by exploiting a critical Fortinet FortiManager flaw dubbed FortiJump (CVE-2024-47575).”
-
Risky Bulletin: Russia arrests DataSuckers hacking group“The company attributed the malware to a group tracked as CL-STA-0954 (aka UNC5820).”
-
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant“… intrusion against a telecommunications organization that occurred in September 2024, which we are tracking as cluster CL-STA-0954 (aka UNC5820).”
Indicators in its reports
named in the reports above- 23.240.77[.]233in 2 reports
- kevincollier.bsky[.]socialin 1 report
- 45.32.41[.]202in 1 report
- 198.199.122[.]22in 1 report
- system[.]autoin 1 report
- hxxp://23.240.77[.]233:8085/in 1 report
- b9fb0b27ddd59b58…533bb9cd1e70in 1 report
- 829b1cd270b30565…8ae4a0431f11in 1 report
- bd064244dad748cf…febd4c1fe02ain 1 report
- 9c4c4436ff5cdf0d…af7a7110437ein 1 report
- fc1b10c58057ef9f…a6e0312b36eein 1 report
- f84eea718526706a…8249c5e379abin 1 report
- b7ae166fd49a7ecf…fb7d14ce15a8in 1 report
- 8d969eef6ecad3c2…0c923adc6c92in 1 report
- hxxp://23.240.77[.]233:8085/pM.jsin 1 report
- hxxp://47.18.167[.]159:8085/pM.jsin 1 report
- 47.18.167[.]159in 1 report
- hxxp://23.240.77[.]233:8084/directoryin 1 report
- hxxp://23.240.77[.]233:8084/acme/new-acctin 1 report
- hxxp://23.240.77[.]233:8084/acme/order/11111in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.