Attackers chained PAN-OS flaws to seize Palo Alto firewalls and deploy malware

Threat actors exploited internet-exposed Palo Alto Networks PAN-OS management interfaces by chaining CVE-2024-0012 and CVE-2024-9474, a combination that enabled authentication bypass followed by privilege escalation to run arbitrary commands as root on affected firewall devices. Security reporting described a surge in exploitation after public disclosure, with campaigns targeting exposed firewalls and quickly moving from initial access to hands-on post-compromise activity.

Investigators observed attackers validating exploitation with OAST domains, retrieving payloads with tools such as curl and wget, and establishing Sliver command-and-control. Follow-on activity included downloads of ELF, shell script, and PHP payloads, persistence through cron jobs and web shells, suspicious TLS traffic without SNI, use of uncommon ports, reconnaissance, lateral movement, and cryptomining tied to infrastructure including herominers and xmrig. One repeatedly downloaded payload, /palofd from 38.180.147[.]18 with SHA1 90f6890fa94b25fbf4d5c49f1ea354a023e06510, was linked by open-source reporting to Spectre RAT, indicating that compromised perimeter devices were being used for broader intrusion activity rather than simple opportunistic exploitation.