Experts warn of Palo Alto firewall exploitation after 2,000 compromises spotted

Thousands of Palo Alto Networks firewalls have been compromised after two new vulnerabilities were disclosed earlier this month. 

Researchers at the U.K.-based Shadowserver Foundation said Thursday they found about 2,000 Palo Alto Networks firewalls breached worldwide, with hundreds in the U.S. and India affected. 

The hackers exploited CVE-2024-0012 and CVE-2024-9474 — two recently disclosed vulnerabilities. For nearly two weeks, experts have raised alarms about potential attacks after Palo Alto Networks released an advisory on the issues, which affect the company’s Next-Generation Firewalls (NGFW) management interfaces and can allow an intruder to take over systems.

Since then, Palo Alto’s own security team, Unit42, and researchers at Arctic Wolf have confirmed that hackers compromised systems using the two vulnerabilities. Palo Alto Networks has released fixes for both vulnerabilities earlier this week and urged customers to restrict access to the devices. The company said a functional exploit chaining CVE-2024-0012 and CVE-2024-9474 is publicly available.

Arctic Wolf said on Friday that in multiple intrusions it has observed, hackers sought to exfiltrate sensitive data from the firewall devices, including configuration files which include credentials allowing for deeper access to networks. 

Some attempts were made to steal operating system passwords and other files, according to Arctic Wolf. 

Palo Alto Networks said it is still investigating ongoing attacks that chain the two vulnerabilities together. In some instances, the hackers have dropped malware into affected systems. 

The Cybersecurity and Infrastructure Security Agency (CISA) ordered all federal civilian agencies to patch the vulnerabilities by December 9 and confirmed that it has seen evidence of both being exploited. 

Keeper Security’s Patrick Tiquet warned that the most immediate danger is attackers taking full control over affected firewalls, compromising the very systems designed to protect sensitive networks. 

“This opens the door for malware deployment, data theft, lateral movement within the network and even complete network shutdowns. For organizations relying on these firewalls, this could mean business disruption, loss of sensitive data and exposure to regulatory and financial consequences,” he explained.