Monday threat briefing: Ransomware crews target unpatched PAN-OS and Ivanti VPNs after weekend probing
Marcus Webb ·
Threat actors stepped up activity against Palo Alto Networks PAN-OS GlobalProtect and Ivanti Connect Secure VPN appliances over the weekend, using known exploits to gain footholds that often lead to ESXi encryption on Monday, according to researchers tracking leak sites, access brokers, and honeypot telemetry. Defenders should assume active exploitation of PAN-OS CVE-2024-3400 and the widely abused Ivanti chains that include CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893 on internet exposed devices.
This matters now because crimeware actors continue to repurpose edge device zero days that first appeared in 2024 long after patches shipped, and they time detonation for the start of the workweek. The pattern mirrors post disruption LockBit activity and opportunistic crews that advertise VPN and firewall access on criminal markets late Sunday.
Active vectors and TTPs
CVE-2024-3400 is a command injection flaw in PAN-OS GlobalProtect that enables code execution on affected versions. It was first exploited by state linked UTA0218, then adopted by crimeware for initial access, web shell placement, and lateral movement into vCenter and ESXi hosts where Linux based lockers are deployed.
Ivanti Connect Secure devices remain high risk due to persistent backdoors observed by Mandiant in the UNC5221 campaigns and widespread reuse of public exploit code. Successful intrusion commonly includes web shell installation, credential theft, and SAML manipulation, followed by domain compromise and hypervisor targeting.
Defenders should hunt for anomalous GlobalProtect portal or gateway requests, unexpected files under PAN-OS web directories, new or modified cron jobs, and outbound connections from management interfaces. On Ivanti, run the latest Integrity Checker Tool, review for unknown admin users, unauthorized SAML identity providers, modified Perl or Python modules, and persistence in temp or data paths, then collect diagnostics for forensics.
Immediate actions
Prioritize upgrades to vendor fixed releases for PAN-OS 10.2, 11.0, and 11.1, and apply configuration workarounds if upgrades cannot complete today. Restrict GlobalProtect and Ivanti portals to trusted IPs, disable clientless features if unused, and segment or isolate management planes from the public internet.
If compromise is suspected on Ivanti, follow vendor guidance to rebuild from a known good image, rotate all credentials, revoke tokens, and reissue certificates. For ESXi, restrict SSH, enforce MFA on vCenter, back up configurations offline, and monitor for abnormal snapshot or datastore activity that precedes encryption.
For the broader technology stack, the weekend cadence underscores that perimeter appliances remain the most reliable path to enterprise ransomware, which keeps pressure on organizations to minimize public exposure, accelerate patch pipelines for edge devices, and push identity checks and network segmentation closer to critical workloads.