CVE-2024-3400 Activity

This report analyzes the Upstyle backdoor suspected to be used in a PAN-OS zero-day firewall exploit: a three-layer malicious implant that achieves persistence by installing code in a Python .pth file, launches only under specific process conditions, and uses encoded commands embedded in SSLVPN error logs to execute and exfiltrate output (temporarily stored in a CSS file) while restoring timestamps and cleaning logs to minimize detection.