1000s of Palo Alto Networks firewalls hijacked as miscreants exploit critical hole

Thousands of Palo Alto Networks firewalls were compromised by attackers exploiting two recently patched security bugs. The intruders were able to deploy web-accessible backdoors to remotely control the equipment as well as cryptocurrency miners and other malware.

Roughly 2,000 devices had been hijacked as of Wednesday - a day after Palo Alto Networks pushed a patch for the holes - according to Shadowserver and Onyphe. As of Thursday, the number of seemingly compromised devices had dropped to about 800.

The vendor, however, continues to talk only of a "limited number" of exploited installations.

"Palo Alto Networks observed threat activity that exploits this vulnerability against a limited number of management web interfaces that are exposed to internet traffic coming from outside the network," according to the supplier's security advisories for the two flaws.

The Register has asked for clarification, including how many compromised devices Palo Alto Networks is aware of, and will update this story if and when we hear back from the vendor.

Rumors started swirling last week about a critical security hole in Palo Alto Networks appliances that allowed remote unauthenticated attackers to execute arbitrary code on devices. The manufacturer did eventually admit that the firewall-busting vulnerability existed, and had been exploited as a zero-day - but it was still working on a patch.

On Tuesday, PAN issued a fix, and at that time said there were actually two vulnerabilities. The first is a critical (9.3 CVSS) authentication bypass flaw tracked as CVE-2024-0012. The second, a medium-severity (6.9 CVSS) privilege escalation bug tracked as CVE-2024-9474. 

The two can be chained together to allow remote code execution (RCE) against the PAN-OS management interface. As Wiz threat researchers explained in a Friday blog about the two bugs:

Wiz says the exploits against the two have been observed since Sunday, and "dramatically increased" after a proof-of-concept exploit went public on Tuesday.

While we don't yet know who is exploiting these vulnerabilities - we've asked Palo Alto Networks about this, too - once the attackers break in, they are using this access to deploy web shells, Sliver implants, and/or crypto miners, according to Wiz.

"In multiple instances, we've identified re-use of the same Sliver implant (b4378712adf4c92a9da20c0671a06d53cbd227c8) which uses 77.221.158[.]154 as its C2 address," the threat intel team wrote. "This IP address has previously resolved the domain censysinspect[.]com, though the domain has since been parked."

The domain also has been used as a command-and-control address for "several" other Sliver implants, some of which have been spotted on other compromised PAN-OS devices, Wiz noted.

"This could indicate that this particular threat actor has been opportunistically compromising PAN-OS devices using various methods over a period of several months, and has also been using them to stage malware," the blog says. ®