Arctic Wolf Observes Threat Campaign Targeting Palo Alto Networks Firewall Devices

Arctic Wolf Labs observed multiple intrusions exploiting PAN-OS vulnerabilities CVE-2024-0012 and CVE-2024-9474 on Palo Alto firewall devices, enabling attackers to inject commands via the username field, download and persist payloads (Sliver C2, XMRig, obfuscated PHP webshells), exfiltrate firewall configs and credentials, and perform timestomping and history clearing; the report provides IoCs, ATT&CK mappings, detections, and remediation recommendations.