Exploitation of CVE-2024-3400 in Palo Alto Networks Firewalls

An active global campaign is targeting organizations with vulnerable Palo Alto Networks firewalls running specific PAN-OS versions. The campaign exploits CVE-2024-3400 within the GlobalProtect gateway feature to gain unauthorized access. OffPerimeter analysis indicates this activity is driven by espionage motivations and targets critical infrastructure across multiple sectors and countries.

First seen

2023-11-12

Last seen

2026-10-06

Threat actors

UNC5478, UNC5470, UNC5463, UNC5439, UNC5716, UNC5807, UNC5859, UNC5174, UNC5454

Malware

PHOTO, METTLE, SLIVER, BEACON, VSHELL, CROSSC2, CRABPOT, STOWAWAY, SNOWLIGHT

Sectors

Defense & Military, Chemicals & Materials, Education & Research, Energy & Utilities, Financial Services, Government, Insurance, Manufacturing

Countries

BD, BR, IN, KR, GB, SK, SG, AU

How it works

The attack chain begins with the exploitation of CVE-2024-3400 on Palo Alto Networks firewalls where the GlobalProtect gateway is enabled. Once initial access is achieved, the actors deploy various malware families to establish persistence and facilitate command and control. The attackers then proceed to perform credential dumping and lateral movement to achieve their espionage objectives.

Techniques (MITRE ATT&CK)

• T1003 · Credential Access
  OS Credential Dumping
  The actors attempt to extract sensitive credentials from the local system to facilitate further movement.
• T1003.008 · Credential Access
  Security Account Manager
  Attackers target the SAM database to obtain local account credentials.
• T1016 · Discovery
  System Network Configuration Discovery
  The campaign involves identifying network settings to map the internal environment.
• T1016.001 · Discovery
  System Network Configuration Discovery: IP Configuration
  Actors examine IP configurations to understand the network topology.
• T1021 · Lateral Movement
  Remote Services
  The threat actors utilize remote services to move between compromised systems.
• T1021.004 · Lateral Movement
  Remote Services: SSH
  SSH is leveraged to access and control remote hosts within the target network.
• T1027 · Defense Evasion
  Obfuscated Files or Information
  Malware and communications are obfuscated to bypass security monitoring.
• T1027.002 · Defense Evasion
  Obfuscated Files or Information: Software Packing
  The actors use software packing to hide the true nature of their malicious payloads.
• T1027.010 · Defense Evasion
  Obfuscated Files or Information: Encrypted Data
  Data is encrypted to prevent detection by deep packet inspection tools.
• T1027.015 · Defense Evasion
  Obfuscated Files or Information: Masquerading
  Malicious files are disguised as legitimate system files or processes.
• T1033 · Initial Access
  External Remote Services
  The exploitation of the GlobalProtect gateway provides access via external remote services.
• T1036 · Defense Evasion
  Masquerading
  The actors use masquerading techniques to blend in with normal user activity.
• T1036.011 · Defense Evasion
  Masquerading: Drive Name/Label
  Attackers may manipulate drive names to hide malicious volumes.
• T1049 · Discovery
  System Information Discovery
  The actors gather system information to tailor their subsequent actions.

Indicators

Indicators associated with this campaign in the sources we reviewed. Corroborate before blocking: an address or domain can be shared infrastructure.

What to do

• Immediately patch Palo Alto Networks PAN-OS to versions unaffected by CVE-2024-3400.
• Disable the GlobalProtect gateway feature if it is not strictly required for business operations.
• Monitor firewall logs for unusual administrative access or unexpected configuration changes.
• Implement strict egress filtering to block communication with known malicious C2 infrastructure.
• Audit all service accounts and rotate credentials for high value administrative users.
• Deploy endpoint detection and response solutions to identify unauthorized credential dumping attempts.