Iran's Pioneer Kitten hits US networks via buggy Check Point, Palo Alto gear

US authorities (FBI, CISA, DC3) warn that Iranian-backed Pioneer Kitten is actively exploiting critical vulnerabilities in VPNs and firewalls (including CVE-2024-3400, CVE-2024-24919 and older Citrix/F5 flaws) to gain access to networks of schools, banks, hospitals, defense contractors and foreign targets. The group uses webshells, stolen admin credentials, created accounts, and backdoors to exfiltrate data and enable ransomware affiliates (NoEscape, Ransomhouse, ALPHV/BlackCat); defenders are advised to patch vulnerable devices, review provided IOCs, and check for cloud account misuse.