UTA0218

UTA0218 is a China-linked threat actor tracked by Volexity and associated with targeted compromises of Palo Alto Networks PAN-OS firewalls. Its exploitation of CVE-2024-3400, an unauthenticated command-injection vulnerability in GlobalProtect, dates to March 2024 and preceded public disclosure. The exploitation campaign is known as Operation MidnightEclipse. No additional actor aliases or subgroups are established. UTA0218 exploited internet-facing firewalls to execute commands as root, establish reverse shells, retrieve additional tools, steal firewall configurations, and access internal networks. It attempted to deploy UPSTYLE, a custom Python backdoor that processes commands embedded in specially crafted network requests and conceals activity by removing command-bearing log entries and restoring modified files and timestamps. Other techniques included scheduled-task persistence through cron, GOST-based SOCKS5 and reverse TCP tunnels, and an open-source SSH reverse-shell tool. In an investigated intrusion, UTA0218 abused a firewall service account with domain-administrator privileges to move laterally through SMB and WinRM. It stole Active Directory credential data, domain and user DPAPI keys, and browser credentials and cookies from selected workstations, compromising domain credentials and enabling potential continued access through stolen authentication material. Its infrastructure included VPN-based anonymization, cloud storage, and virtual private servers. Hands-on intrusions were targeted, while vulnerability reconnaissance was broader. Independent exploitation of CVE-2024-3400 by ransomware operators does not establish a ransomware role or operational relationship for UTA0218.