Monday briefing: Ransomware crews still exploiting Palo Alto and Ivanti edge flaws after holiday weekend

Security teams returning on Monday should expect continued exploitation of edge appliances, with attackers leveraging PAN OS CVE-2024-3400 and Ivanti Connect Secure CVE-2023-46805 and CVE-2024-21887 for initial access. The targets are internet facing VPN and firewall gateways in North America and Europe, a favored entry point during long weekends because these systems often sit outside endpoint detection coverage.

This matters now because both exploit chains remain in active use, they feature in CISA’s Known Exploited Vulnerabilities catalog, and reliable attack tooling is widely available. Affiliates tied to data theft and ransomware operations have used these paths to drop web shells, pivot to hypervisors, and encrypt file servers.

Active exploits on edge appliances

PAN OS CVE-2024-3400 enables unauthenticated command execution on GlobalProtect gateways. Microsoft and Palo Alto Networks previously linked activity to UTA0218, with follow on actions that include deploying web shells, modifying scheduled tasks, and pulling down second stage payloads. Fixed builds include PAN OS 10.2.9 h1, 11.0.4 h1, and 11.1.2 h3.

Ivanti Connect Secure intrusions commonly chain CVE-2023-46805 for auth bypass with CVE-2024-21887 for command injection. Successful attacks have added rogue administrators, altered SAML settings, and used curl or wget to stage tooling, followed by lateral movement to domain controllers and VMware ESXi. Ivanti advises upgrading to the latest maintenance release and performing a factory reset if compromise is suspected.

Immediate actions for defenders

Patch and verify. Confirm PAN OS versions are at or above 10.2.9 h1, 11.0.4 h1, or 11.1.2 h3, and that Ivanti appliances run vendor fixed builds. If patching lags, geofence or temporarily disable external access to administration portals.

Hunt for persistence. On PAN OS, inspect for unexpected files or scripts under var tmp or usr local, unknown scheduled tasks, and unusual outbound sessions from the management interface. On Ivanti, check for new admin accounts, altered SAML or LDAP connectors, and shell artifacts under tmp directories.

Contain and rotate. Invalidate VPN sessions, rotate administrator and service credentials, revoke OAuth and SAML tokens, and review hypervisor access for signs of staging. Monitor for data theft via Rclone or MEGA and block known exfiltration endpoints.

The broader trend is clear. Perimeter appliances without full telemetry remain high value for intrusion operators, which pushes enterprises to converge network and endpoint visibility, reduce appliance sprawl, and favor architectures where identity and patch agility outweigh static perimeter controls.