Monday threat briefing: attackers still exploiting PAN‑OS GlobalProtect flaw CVE‑2024‑3400, weekend intrusions reported

Attackers continued to exploit Palo Alto Networks PAN‑OS vulnerability CVE‑2024‑3400 over the weekend, targeting internet‑exposed GlobalProtect gateways and firewalls. Security researchers and managed detection teams reported fresh intrusions and post‑exploitation beacons against organizations that have not applied fixed PAN‑OS releases, or that relied on incomplete mitigations.

The flaw, an authentication bypass and command execution bug disclosed in April 2024, was first used by UTA0178, a China‑nexus actor identified by Unit 42. It later became commodity tradecraft, with criminal affiliates using access for lateral movement and data theft. CISA added CVE‑2024‑3400 to the Known Exploited Vulnerabilities catalog, which signals active exploitation pressure and sets patch deadlines for federal agencies.

Exploitation remains straightforward against portals reachable from the public internet. Analysts observed attackers dropping lightweight persistence on the device, including webshell‑style handlers on GlobalProtect components and scheduled tasks that execute curl or wget to pull second‑stage payloads. In several cases, access to the firewall served as a pivot to on‑premises hypervisors and identity systems, which aligns with post‑April reporting from Volexity and Mandiant.

Some environments misapplied temporary mitigations that did not fully block exploit paths. Palo Alto Networks has advised that only upgrading to fixed PAN‑OS versions remediates the issue. Devices that were exposed before patching should be treated as compromised, because appliances often lack full endpoint telemetry and attackers frequently remove obvious artifacts.

What security teams should do today:

• Validate that all GlobalProtect and PAN‑OS devices are on fixed releases listed in Palo Alto advisories. Do not rely on signatures or policy workarounds alone.
• Hunt on appliances for anomalous files or tasks, including unexpected scripts, crontab entries, or binaries with recent timestamps. Review portal and system logs for unusual requests, repeated authentication‑less access to GlobalProtect endpoints, or outbound connections initiated by the firewall.
• Rotate local admin credentials, API keys, and device certificates. Rebuild the device from a trusted image if exposure predated patching, then restore from known‑good configuration backups.
• Restrict external access to GlobalProtect portals by source address where feasible, enable client certificates, and ensure management interfaces are not internet‑accessible.

Perimeter appliances continue to be prime initial access targets because they straddle trust boundaries and often sit outside standard EDR coverage. The weekend activity underscores a broader need to treat network appliances as high‑risk assets with rapid patch SLAs, rigorous configuration control, and architectural guardrails that limit blast radius when a device is compromised.