Monday threat intel: Attackers continue to hit Palo Alto, Ivanti, and Fortinet edge devices
Marcus Webb ·
Security teams starting the week face renewed probing of internet exposed network appliances, with active exploitation continuing against Palo Alto Networks PAN OS CVE-2024-3400, Ivanti Connect Secure and Policy Secure flaws, and Fortinet FortiOS and FortiProxy CVE-2024-21762. Adversaries favor Monday mornings for fresh footholds on devices that often lack endpoint telemetry and are slow to patch.
This matters because these appliances sit in the authentication path. Successful exploitation reliably yields code execution or VPN session hijacking, which ransomware operators including LockBit affiliates, Akira, and RansomHub have used for lateral movement.
What security teams should do now
For Palo Alto Networks GlobalProtect portals and gateways, verify you are on fixed PAN OS releases for CVE-2024-3400. Hunt for unusual scheduled tasks, unknown admin accounts, and modified files under web server directories on the device. Review GlobalProtect authentication logs for anomalous source IPs and impossible travel, then rotate admin and service credentials.
For Ivanti Connect Secure and Policy Secure, apply the latest cumulative fixes that address the authentication bypass and command injection chains disclosed across 2023 and 2024, including CVE-2023-46805 and CVE-2024-21887. Run Ivanti’s integrity check tooling, validate that the device’s read only partitions and system binaries have not been altered, and export then review logs offline. If indicators appear, factory reset and rebuild from known good images.
For Fortinet FortiOS and FortiProxy, prioritize patching for CVE-2024-21762 on SSL VPN appliances. Inspect for abnormal processes tied to the SSL VPN service, unexpected administrator accounts, and suspicious files in temporary or web directories. Enforce MFA on all VPN access and audit for dormant local accounts that bypass identity controls.
Across all appliances, block management access from the internet, restrict portal exposure, and place devices behind dedicated management networks. Collect full packet captures around the devices where feasible, forward logs to a SIEM, and set detections for new or modified files on the filesystem, unexpected cron or scheduled tasks, and outbound connections from the device to rare destinations.
Background and risk
Public reporting through 2024 showed rapid weaponization of bugs in perimeter tech such as PAN OS CVE-2024-3400 and Fortinet CVE-2024-21762, with multiple state linked and criminal actors testing opportunistic exploitation. Organizations that paused changes for quarter end maintenance or summer holidays often carry residual exposure into the first business day, which increases the risk of mass exploitation and follow on ransomware deployment.
The broader trend remains steady. Perimeter appliances are high value targets that blend network, identity, and remote access, and they often sit outside standard endpoint monitoring. Vendors have increased out of band advisories and hotfixes for these classes of flaws, so defenders should treat appliance patching and forensic readiness as a standing Monday task rather than an exception.