Flagthis: Fake Palo Alto GlobalProtect Malware

Threat actors are targeting organizations in the Middle East with malware disguised as the legitimate Palo Alto GlobalProtect tool.
The malware can steal data and execute remote PowerShell commands to infiltrate internal networks further.
The malware uses a two-stage infection process and a sophisticated C&C infrastructure.
The malware employs the Interactsh project for beaconing and communication, while leveraging its capabilities to execute remote PowerShell commands, download and exfiltrate data.
This attack is a reminder of the need to be cautious about suspicious downloads and to verify the authenticity of software before installing it.

@BleepingComputer - Information Security Exchange's information on the Fake Palo Alto GlobalProtect Malware.
Over Security - Cybersecurity news aggregator - Fake Palo Alto GlobalProtect used as lure to backdoor enterprises
@BleepingComputer - Threat actors target Middle Eastern organizations with malware disguised as the legitimate Palo Alto GlobalProtect Tool that can steal data and execute remote PowerShell commands to infiltrate internal networks further.
www.darkreading.com - Dark Reading article on the Fake Palo Alto GlobalProtect malware
CISA Cybersecurity Advisories - CISA advisory on fake Palo Alto GlobalProtect malware
Trend Micro Research, News and Perspectives - Trend Micro published a blog post on the fake Palo Alto GlobalProtect tool and its use in a malware campaign, providing details on the malware's capabilities.
The Hacker News - The Hacker News reports on the Palo Alto VPN malware campaign.
Unit 42 - Spoofed GlobalProtect Used to Deliver Unique WikiLoader Variant

Classification:

Flag This