gbhackers.com • 2h
Ransomware Exploitation of Palo Alto Networks GlobalProtect CVE-2024-3400
CVE-2024-3400 is a critical command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect gateways. Unauthenticated attackers exploit the flaw by sending crafted HTTP requests containing shell metacharacters (e.g., ;, &, |) within the user or hostname parameters of the GlobalProtect portal. This enables arbitrary OS command execution, facilitating the deployment of ChinaChopper webshells and the UpStyle Python backdoor for persistent command-and-control (C2) communication via reverse TCP tunnels. Weaponized by ransomware affiliates—including LockBit 3.0 and Clop—the exploit chain is used to harvest credentials and encrypt critical systems, resulting in significant impact across healthcare, government, and financial sectors.
Links:gbhackers.com, Hhs, Kroll, Zscaler, Sentinelone, Rapid7, Darktrace, Armis, Ncsc, Reddit •