File · UNC5820 · Unknown · refreshed 2026-10-18 · on the wire
UNC5820
sigil · no ATT&CK coverage stated
What changed
ledger · newest first- 2026-10-18yesterdaynew CVE1 new CVE: CVE-2024-47575
Analyst brief
UNC5820 is a threat actor exploiting the CVE-2024-47575 vulnerability in Fortinet's FortiManager, allowing them to bypass authentication and execute arbitrary commands. They have been observed exfiltrating configuration data, user information, and FortiOS256-hashed passwords from managed FortiGate devices. While the actor has staged and exfiltrated sensitive data, there is currently no evidence of lateral movement or further compromise of additional environments. Mandiant has not determined whether UNC5820 is state-sponsored or identified its geographic location.
CVEs UNC5820 is cited as exploiting
1 on CISA KEV- CVE-2024-47575KEV2026-10-17
“which we are tracking as cluster CL-STA-0954 (aka UNC5820). The attackers behind CL-STA-0954 achieved an initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance.”
cited as exploiting · source: unit42.paloaltonetworks.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Detections
3 rules · Sigma · QRadar · CortexGenerated by skopnix from this finding, each with false-positive notes. Open the list →
On the wire
1 dispatch · newest firstTake it with you
keyless · no signupReferences
1 sourceTrack UNC5820 on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.