Hackers Deploy Python Backdoor in Palo Alto Zero-Day Attack

**Operation MidnightEclipse (CVE-2024-3400)**: A critical PAN-OS command-injection zero-day (CVSS 10.0) has been exploited in the wild to install a Python backdoor (tracked as UPSTYLE) on GlobalProtect-enabled Palo Alto firewalls; the attacker (UTA0218) creates cron jobs that fetch and execute commands, uses forged requests to embed commands in legitimate log/web files, and rapidly restores file contents to minimize traces while stealing DPAPI keys, NTDS.DIT, and credentials for lateral movement and data exfiltration.