Palo Alto Firewalls Backdoored by Suspected Chinese Hackers

A suspected Chinese hacking campaign is exploiting a vulnerability in Palo Alto firewalls to install custom malware backdoor for espionage.

See Also: Corelight’s Brian Dye on NDR’s Role in Defeating Ransomware

The unnamed malware backdoor is a variant of Littlelamb.Wooltea, said researchers from cybersecurity firm Northwave. The malware has been previously linked to a Chinese hacking group tracked as UNC5325.

This campaign began in November shortly after Palo Alto disclosed a medium-severity privilege escalation flaw tracked as CVE-2024-9474 impacting its PAN-OS software, Northwave said. The flaw allows threat actors to run actions on the firewall with root privileges.

Hackers exploited the flaw to download a file called bwmupdate, which installs the malware backdoor disguised as a logd file. The variant is equipped with 30 commands that facilitate core functionalities, and comes with advanced stealth capabilities, Northwave researchers said.

The malware capabilities include reading and writing files, establishing a network tunnel that listens to outgoing connections, facilitating shell connections and setting up a SOCKS5 proxy to coordinate multiple listening ports and track outgoing connections.

The malware uses multiple nodes to manage network connections. It achieves this by sending messages for establishing network handshakes, tracking lost connections and listening to nodes. In addition to the malware backdoor, threat actors exploiting the vulnerability have deployed additional payloads to retrieve content from external servers or repositories, according to a report from security firm Darktrace earlier this month.

Palo Alto in November said in addition to CVE-2024-9474, hackers also exploited another PAN-OS vulnerability tracked as CVE-2024-0012. The company patched the two flaws.

It advised system administrators to restrict access to the web management portal to trusted IP addresses only. Palo Alto added the attacks only impacted a “small number of PAN-OS devices,” although researchers estimate these to be in thousands.

Chinese Campaign Targeting Edge Devices

Details about UNC5325 remain sparse, with Mandiant in February stating the group is a China-nexus threat actor. The group was behind a similar hacking campaign that exploited a zero-day Ivanti Connect Secure VPN vulnerability to install a backdoor.

A similar report by security firm Fortinet also disclosed a suspected Chinese campaign that exploited two n-days in Fortinet firewalls.

UNC5325 activity aligns with the Chinese hacking strategy of targeting edge devices. UNC3886 and UNC4841 are among other China-nexus actors deploying similar tactics (see: State Hackers’ New Frontier: Network Edge Devices).