Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

November 2024

Arctic Wolf

Arctic Wolf Observes Threat Campaign Targeting Palo Alto Networks Firewall Devices

Nov 22, 2024 By Julian Tuin, Stefan Hostetler, Jon Grimm, Aaron Diaz, and Trevor Daher In Arctic Wolf
On November 18, 2024, Palo Alto Networks disclosed the existence of two vulnerabilities (CVE-2024-0012 and CVE-2024-9474) in Palo Alto Networks OS (PAN-OS), the operating system used on their firewall devices. A day later, watchTowr released a report providing technical details on how to chain the two vulnerabilities together to achieve remote code execution of these vulnerabilities.
Read Post
Arctic Wolf

What is DFIR?

Nov 21, 2024 By Arctic Wolf In Arctic Wolf
As the threat landscape evolves alongside organizations’ move toward digital-first operations and cloud-based applications, part of a robust cybersecurity strategy becomes not just preventing attacks but knowing how best to respond if and when one occurs. That response, specifically digital forensics incident response (DFIR), is the key to mitigating and recovering from a cyber incident.
Read Post
Arctic Wolf

Follow-Up: Arctic Wolf Observes Ongoing Exploitation of Critical Palo Alto Networks Vulnerability CVE-2024-0012 Chained with CVE-2024-9474

Nov 20, 2024 By Andres Ramos In Arctic Wolf
On November 19, 2024, Arctic Wolf began observing active exploitation of the recently-disclosed CVE-2024-0012 and CVE-2024-9474 vulnerabilities impacting Palo Alto Networks PAN-OS software. When chained together, these vulnerabilities allow an unauthenticated threat actor with network access to the management web interface to gain administrator privileges.
Read Post
Arctic Wolf

Redefining Modern Security with the Introduction of the Arctic Wolf Aurora Platform, Powered by Alpha AI

Nov 19, 2024 By Dan Schiappa In Arctic Wolf
In today’s rapidly evolving threat landscape, where cyberattacks grow more sophisticated by the day, staying ahead requires more than vigilance—it demands a platform built to operate at scale. Enter the Arctic Wolf Aurora Platform, the new name for our industry-leading security operations platform. With the ability to process over seven trillion events weekly, The Aurora Platform stands as one of the largest and most advanced cybersecurity platforms in our industry.
Read Post
Arctic Wolf

Follow-Up: Critical Authentication Bypass Vulnerability in Palo Alto Networks Firewalls Actively Exploited (CVE-2024-0012)

Nov 18, 2024 By Andres Ramos In Arctic Wolf
On November 18, 2024, Palo Alto Networks (PAN) released updated information on an actively exploited vulnerability impacting PAN-OS, the operating system that powers PAN firewalls. Originally disclosed last week as a remote command execution vulnerability, this flaw has now been reclassified as an authentication bypass flaw and assigned CVE-2024-0012.
Read Post
Arctic Wolf

The Role of Pretexting in Cyber Attacks

Nov 18, 2024 By Arctic Wolf In Arctic Wolf
A threat actor sends an email to a user at an organization claiming to be from the IT department. They need a password to a critical application, and the email is convincing – it mentions aspects of the application that would only be known to the user, it brings up a recent update email that was sent out company wide, and it even closes with a friendly, “Hope to see at next week’s happy hour!” in the sign-off.
Read Post
Arctic Wolf

Critical Unauthenticated Remote Command Execution Vulnerability in Palo Alto Networks Firewalls Actively Exploited

Nov 15, 2024 By Andres Ramos In Arctic Wolf
On November 14, 2024, Palo Alto Networks (PAN) revealed that a critical unauthenticated remote command execution vulnerability is being actively exploited against internet-exposed firewall management interfaces. According to their security advisory, Prisma Access and Cloud NGFW are not impacted by this issue. A CVE has not yet been assigned to the vulnerability.
Read Post

The Howler Episode 14: Jeff Green, Senior Vice President, R&D

Nov 7, 2024 By Arctic Wolf In Arctic Wolf
This month we sit down with Jeff Green, Senior Vice President of R&D, as he shares his experience helping open our brand-new India office, leadership advice he swears by, and more! Jeff is an industry veteran with over 30 years of experience in building world-class products and technologies for enterprises and consumers primarily focused in security. Currently as Senior Vice President of R&D, Jeff leads Arctic Wolf’s global research and engineering organization with a focus on delivering security outcomes for customers and ending cyber risk at high scale.
View Video
Arctic Wolf

CVE-2024-42509, CVE-2024-47460: Critical RCE Vulnerabilities Impacting HPE Aruba Networking Access Points

Nov 7, 2024 By Andres Ramos In Arctic Wolf
On November 5, 2024, Hewlett Packard Enterprise (HPE), the parent company of Aruba Networks, released a security bulletin addressing two critical-severity vulnerabilities affecting Aruba Networks Access Points. These vulnerabilities, identified as CVE-2024-42509 and CVE-2024-47460, could allow unauthenticated command injection.
Read Post
Arctic Wolf

CVE-2024-10443: Critical Zero-Click RCE Vulnerability Discovered in Synology NAS Devices

Nov 4, 2024 By Andres Ramos In Arctic Wolf
On November 1, 2024, details of a critical vulnerability affecting Synology NAS devices, which had been patched a few days earlier, were publicly disclosed. This vulnerability, tracked as CVE-2024-10443 is classified as a zero-click flaw, meaning no user interaction is required for exploitation. The issue originates from the SynologyPhotos application, which comes pre-installed and enabled by default on Synology’s BeeStation storage devices and is also widely used among DiskStation users.
Read Post

Copyright © 2024 OpsMatters™. All rights reserved.