MITRE ATT&CKsoftware (malware)
S1164 UPSTYLE
- Domain
- enterprise
- Platforms
- Network Devices, Linux
- Version
- 1.0
- Created
- 2024-11-20
Description
UPSTYLE is a Python-based backdoor associated with exploitation of Palo Alto firewalls using CVE-2024-3400 in early 2024. UPSTYLE has only been observed in relation to this exploitation activity, which involved attempted install on compromised devices by the threat actor UTA0218.
Related
Uses · MITRE ATT&CK (12)
- T1685.006 Clear Linux or Mac System Logs sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1665 Hide Infrastructure technique
- T1001.001 Junk Data sub-technique
- T1102.003 One-Way Communication sub-technique
- T1059.006 Python sub-technique
- T1070.004 File Deletion sub-technique
- T1070.006 Timestomp sub-technique
- T1546 Event Triggered Execution technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1036 Masquerading technique
- T1057 Process Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- C0048 Operation MidnightEclipse campaign
References
- https://unit42.paloaltonetworks.com/cve-2024-3400/ Palo Alto MidnightEclipse APR 2024
- https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/ Volexity UPSTYLE 2024