Arctic Wolf Observes Threat Campaign Targeting Palo Alto Networks Firewall Devices

Arctic Wolf Labs observed rapid mass exploitation of two PAN-OS vulnerabilities (CVE-2024-0012 and CVE-2024-9474) following public technical disclosures; attackers chained an authentication bypass and a privilege escalation to achieve remote code execution on Palo Alto firewall devices, resulting in command injection, exfiltration of configuration and credential files, deployment of Sliver C2 frameworks and PHP webshells, and installation of XMRig coinminers. The report provides exploitation log samples, lists observed IoCs (IP addresses, URLs, a SHA256 hash), maps TTPs to ATT&CK techniques, and outlines detection and remediation guidance for defenders.