Dive Brief:

• Shadowserver researchers and Palo Alto Networks are disputing the number of compromised instances in the security vendor’s PAN-OS operating system. While Shadowserver identified around 2,000 compromised instances, Palo Alto Networks said it was less extensive. 
• About Palo Alto Networks customers’ firewalls are compromised by a widening spree of exploits targeting a zero-day in the security vendor’s PAN-OS operating system, Shadowserver scans showed Thursday.
• Palo Alto Networks disputed Shadowserver’s findings. “While we can’t confirm the exact number, I can tell you it is a smaller number,” Steven Thai, senior manager of global crisis communications and reputation management at Palo Alto Networks, said in a Thursday email.

Dive Insight:

Shadowserver, a nonprofit that shares daily analysis with more than 200 national computer security incident response teams, typically scans for devices exposed to the internet and potentially vulnerable to known exploits. 

Yet, in this case, Shadowserver’s research and collaboration with the Saudi National Cybersecurity Authority identified artifacts left behind by attackers, which can be detected remotely, Shadowserver CEO Piotr Kijewski said in a Friday email. 

Shadowserver’s research is a partial rebuttal to Palo Alto Networks’ assertion that only a limited number of customers’ firewall management interfaces have been exploited.

“The ecosystem of firewalls overall is millions. But our perspective is that even one impacted firewall is one too many and that is why we frequently communicate and post when we see any potential vulnerability,” Thai said. 

“Less than half a percent of Palo Alto Networks firewalls deployed by customers have an internet-exposed management interface.”

The security vendor initially published a security advisory about an unconfirmed vulnerability in the PAN-OS management interface on Nov. 8. The company observed threat activity targeting the vulnerability on Nov. 14 and added indicators of compromise on Nov. 15. 

On Monday, a CVE was assigned to the critical authentication bypass vulnerability, CVE-2024-0012, and Palo Alto Networks issued a patch. The Cybersecurity and Infrastructure Security Agency added CVE-2024-0012 and CVE-2024-9474, another vulnerability in PAN-OS that can be exploited in tandem, to its known exploited vulnerabilities catalog on Monday.

Shadowserver scans identified an increase in threat activity targeting the CVEs starting Tuesday, when more threat groups presumably began exploiting the vulnerabilities, Kijewski said. 

Palo Alto Networks threat intelligence firm Unit 42 is tracking the initial exploitation of CVE-2024-0012 as Operation Lunar Peek. 

“We are actively working with those who may be impacted and are committed to supporting the security of our customers,” Thai said.

The active exploits of Palo Alto Networks customers’ firewalls follows a trio of actively exploited zero-days in Expedition, the company’s tool for migrating customers over from other vendors, earlier this month. Attackers also hit a maximum severity zero-day in PAN-OS earlier this year.