Operation MidnightEclipse | Threat Actor Index

Techniques

Malware Used

Attributed Groups

Tactics Covered

About This Campaign

Operation MidnightEclipse was a campaign conducted in March and April 2024 that involved initial exploit of zero-day vulnerability CVE-2024-3400, a critical command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS.

Techniques by Tactic (17)

Resource Development

T1584.003 Virtual Private ServerT1584.006 Web ServicesT1588.002 Tool

Initial Access

T1078 Valid AccountsT1078.002 Domain AccountsT1190 Exploit Public-Facing Application

Execution

T1053.003 CronT1059.004 Unix ShellT1559 Inter-Process Communication

Persistence

T1053.003 CronT1078 Valid AccountsT1078.002 Domain Accounts

Privilege Escalation

T1053.003 CronT1078 Valid AccountsT1078.002 Domain Accounts

Stealth

T1078 Valid AccountsT1078.002 Domain Accounts

Credential Access

T1003.003 NTDS

Lateral Movement

T1021.002 SMB/Windows Admin SharesT1021.006 Windows Remote Management

Collection

T1005 Data from Local SystemT1074.001 Local Data Staging

Command & Control

T1071.001 Web ProtocolsT1090 ProxyT1105 Ingress Tool Transfer

↑