Arctic Wolf Observes Threat Campaign Targeting Palo Alto Networks Firewall Devices

Arctic Wolf Labs observed a mass exploitation campaign targeting PAN-OS management interfaces that chained CVE-2024-0012 (authentication bypass) with CVE-2024-9474 (privilege escalation) to gain administrative and root access to Palo Alto firewall devices; actors downloaded payloads via curl/wget (notably Sliver C2 and UPX-packed Sliver payloads), deployed an obfuscated PHP webshell and XMRig coinminer, staged and exfiltrated firewall configuration and credential files, and left multiple IoCs and detection recommendations.