Arctic Wolf Observes Threat Campaign Targeting Palo Alto Networks Firewall Devices - Arctic Wolf
Tags
cmtmf-attack-pattern: Exploit Public-Facing Application Obfuscated Files Or Information
country: Jordan
attack-pattern: Data Models /Etc/Passwd And /Etc/Shadow - T1003.008 Archive Collected Data - T1560 Archive Collected Data - T1532 Artificial Intelligence - T1588.007 Bash History - T1552.003 Botnet - T1583.005 Botnet - T1584.005 Clear Command History - T1070.003 Credentials - T1589.001 Cron - T1053.003 Domains - T1583.001 Domains - T1584.001 Exploitation For Privilege Escalation - T1404 Exploit Public-Facing Application - T1377 Ingress Tool Transfer - T1544 Ip Addresses - T1590.005 Javascript - T1059.007 Local Data Staging - T1074.001 Malware - T1587.001 Malware - T1588.001 Obfuscated Files Or Information - T1406 Resource Hijacking - T1496 Server - T1583.004 Server - T1584.004 Software - T1592.002 Ssh - T1021.004 Timestomp - T1070.006 Tool - T1588.002 Vulnerabilities - T1588.006 Automated Collection - T1119 Bash History - T1139 Clear Command History - T1146 Credential Dumping - T1003 Exploit Public-Facing Application - T1190 Exploitation For Privilege Escalation - T1068 Indicator Removal On Host - T1070 Remote File Copy - T1105 Obfuscated Files Or Information - T1027 Timestomp - T1099 Automated Collection Exploit Public-Facing Application
Show in Graph
Common Information
Type Value
UUID d56be840-79ba-4865-9150-83d498b73547
Fingerprint b3cba8c0ecb79383
Analysis status DONE
Considered CTI value 2
Text language
Published Nov. 22, 2024, 4:54 p.m.
Added to db Nov. 23, 2024, 12:36 a.m.
Last updated Dec. 24, 2024, 11:39 p.m.
Headline Arctic Wolf Observes Threat Campaign Targeting Palo Alto Networks Firewall Devices
Title Arctic Wolf Observes Threat Campaign Targeting Palo Alto Networks Firewall Devices - Arctic Wolf
Detected Hints/Tags/Attributes 112/3/46
Source URLs
Redirection Url
Details Source https://arcticwolf.com/resources/blog-uk/threat-campaign-targeting-palo-alto-networks-firewall-devices/
URL Provider
Details Provider Source level domain
Details arcticwolf.com arcticwolf.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 16 ✔ Arctic Wolf https://arcticwolf.com/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details CVE 66 
cve-2024-0012
Details CVE 58 
cve-2024-9474
Details CVE 50 
cve-2024-3400
Details Domain 1 
img.dxyjg.com
Details Domain 1 
sys.traceroute.vip
Details File 97 
1.txt
Details File 41 
1.php
Details File 1 
watchtowr.js
Details File 2 
watchtowr.php
Details File 1 
watchtowr.txt
Details File 1 
cve20249474.php
Details File 1 
vicidial_sign.js
Details File 1 
up.js
Details File 45 
php.ini
Details File 1 
f03.png
Details File 38 
2.txt
Details File 6 
pay.txt
Details File 6 
register.html
Details sha256 1 
a3092bfa4199def7fc525465895ee3784c6fcf55f0a7e9c8436c027e0f41cb4b
Details IPv4 1 
46.8.226.75
Details IPv4 1 
104.131.69.106
Details IPv4 1 
104.21.52.167
Details IPv4 1 
156.244.14.127
Details IPv4 1 
180.210.220.139
Details IPv4 1 
143.198.1.178
Details IPv4 1 
38.180.147.18
Details IPv4 1 
31.41.221.158
Details IPv4 1 
185.196.9.154
Details IPv4 1 
95.164.5.41
Details IPv4 1 
93.113.25.46
Details IPv4 1 
107.191.48.109
Details IPv4 1 
38.60.214.5
Details IPv4 2 
77.221.158.154
Details MITRE ATT&CK Techniques 593 
T1190
Details MITRE ATT&CK Techniques 222 
T1068
Details MITRE ATT&CK Techniques 681 
T1027
Details MITRE ATT&CK Techniques 23 
T1070.003
Details MITRE ATT&CK Techniques 98 
T1070.006
Details MITRE ATT&CK Techniques 17 
T1003.008
Details MITRE ATT&CK Techniques 166 
T1560
Details MITRE ATT&CK Techniques 118 
T1119
Details MITRE ATT&CK Techniques 55 
T1074.001
Details MITRE ATT&CK Techniques 524 
T1105
Details MITRE ATT&CK Techniques 2 
T1496.001
Details Url 1 
https://104.131.69.106/vicidial/vicidial_sign.js|bash
Details Url 1 
https://104.131.69.106/vicidial/up.js