MITRE ATT&CKcampaign
C0048 Operation MidnightEclipse
- Domain
- enterprise
- Version
- 1.0
- Created
- 2025-01-15
Description
Operation MidnightEclipse was a campaign conducted in March and April 2024 that involved initial exploit of zero-day vulnerability CVE-2024-3400, a critical command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS.
Related
Uses · MITRE ATT&CK (18)
- S1164 UPSTYLE software (malware)
- T1584.003 Virtual Private Server sub-technique
- T1584.006 Web Services sub-technique
- T1588.002 Tool sub-technique
- T1071.001 Web Protocols sub-technique
- T1074.001 Local Data Staging sub-technique
- T1078.002 Domain Accounts sub-technique
- T1059.004 Unix Shell sub-technique
- T1559 Inter-Process Communication technique
- T1003.003 NTDS sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1021.006 Windows Remote Management sub-technique
- T1053.003 Cron sub-technique
- T1190 Exploit Public-Facing Application technique
- T1005 Data from Local System technique
- T1078 Valid Accounts technique
- T1090 Proxy technique
- T1105 Ingress Tool Transfer technique
References
- https://unit42.paloaltonetworks.com/cve-2024-3400/ Palo Alto MidnightEclipse APR 2024
- https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/ Volexity UPSTYLE 2024