PAN-OS Firewall Exploitation Enables Root Access and Stealthy Backdoor Persistence

Attackers exploited Palo Alto Networks PAN-OS firewalls using CVE-2024-0012, an authentication bypass, and CVE-2024-9474, a privilege-escalation vulnerability that can be chained to execute commands as root without authentication. Darktrace’s investigation of activity associated with Operation Lunar Peek during November 2024 identified exploit validation, PHP web shells, downloads associated with Spectre RAT, and Sliver command-and-control communications. Some compromised devices also showed cryptocurrency mining, internal reconnaissance, and possible lateral movement. Darktrace did not attribute the activity to a single actor, and some payload functions and links to exploitation remained unconfirmed.

Separately, Northwave reported a stealthy backdoor assessed as associated with LITTLELAMB.WOOLTEA during an active firewall compromise involving suspected exploitation of CVE-2024-9474. The suspected nation-state attacker installed malware masquerading as the logd service, with persistence designed to survive system upgrades. The backdoor injects a library into nginx, recognizes operator connections through a 48-byte magic knock, and reuses an existing listening port and the management-interface certificate for encrypted communications. Capabilities include shell access, file transfers, multi-node routing, tunneling, and SOCKS5-style proxying, although some tunneling functions were broken or limited. Northwave did not establish a specific actor identity or a connection to Darktrace’s observations. These findings underscore the need to patch affected firewalls, restrict management-interface exposure, and investigate suspected compromises for persistent implants rather than treating patching alone as remediation.