Anatomy of a Cyber Attack: The PAN-OS Firewall Zero-Day

Arctic Wolf analyzes CVE-2024-3400, a critical (CVSS 10.0) PAN-OS GlobalProtect zero-day actively exploited in the wild to achieve unauthenticated root remote code execution; the adversary UTA0218 used content-injection via cookies and path traversal to write files, schedule cron jobs, and install a Python backdoor (UPSTYLE) to gain persistence and stage further intrusions, while Palo Alto released hotfixes for affected PAN-OS versions and Arctic Wolf executed a coordinated mega-event response to detect and block exploitation.