LiveActive security incident?Get immediate response
MITRE ATT&CK® Campaign

C0048: Operation MidnightEclipse

Operation MidnightEclipse was a campaign conducted in March and April 2024 that involved initial exploit of zero-day vulnerability CVE-2024-3400, a critical command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS.[1][2]

EnterpriseC0048CampaignObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Operation MidnightEclipse matters because it shows how a critical zero-day in an internet-facing security appliance can become the entry point for broader enterprise activity. For leaders, the key issue is not only whether CVE-2024-3400 was patched, but whether the organization can prove exposure, compromise assessment, credential review, lateral movement checks, and post-exploitation monitoring were completed.

Executive priority

Prioritize this as an edge-device and incident-readiness case. The campaign is tied to exploitation of CVE-2024-3400 in Palo Alto Networks PAN-OS GlobalProtect and to follow-on behaviors involving a backdoor, command execution, tool transfer, credential access, data collection, staging, command-and-control, and lateral movement techniques. Executives should ask for evidence of affected-asset inventory, patch/remediation status, firewall log retention, identity impact review, domain controller monitoring, and incident response decisions made after exposure was identified.

Technical view

ATT&CK does not provide campaign-specific detection guidance, so defenders should validate coverage against the related behaviors. Confirm whether exposed GlobalProtect/PAN-OS assets were inventoried and reviewed for signs associated with CVE-2024-3400 and UPSTYLE. For SOC and IR teams, the practical pivot is from edge compromise to enterprise impact: Unix shell execution, cron persistence, web-protocol C2, proxy use, ingress tool transfer, local data collection/staging, valid account abuse, SMB/WinRM lateral movement, and NTDS access attempts. Because the campaign object itself has no specified platforms or tactics, platform assumptions should be driven by the related software and techniques plus local asset evidence.

Likely telemetry

  • Internet-facing firewall and GlobalProtect/PAN-OS logs, including management, system, authentication, and traffic records where available
  • Network device file integrity, process, shell, and scheduled task/cron evidence where collected
  • HTTP/HTTPS egress logs, proxy logs, DNS records, and firewall traffic metadata for unusual command-and-control patterns
  • File creation, modification, and transfer evidence on affected network devices and adjacent Linux systems
  • Identity provider, VPN, and privileged account authentication logs for valid-account misuse

Detection direction

  • Start with exposure validation: identify PAN-OS GlobalProtect assets potentially affected by CVE-2024-3400 during the March-April 2024 campaign window described by ATT&CK and the cited reports.
  • Tune detections for the relationship-driven chain rather than a single indicator: edge exploitation, UPSTYLE-related backdoor activity, Unix shell execution, cron changes, ingress tool transfer, proxy or web-protocol C2, and local staging.
  • Correlate edge-device events with identity activity. Valid accounts and domain accounts are related techniques, so unexpected VPN, privileged, service, or domain account use after edge-device anomalies should be investigated.
  • Validate Windows lateral movement coverage for SMB admin shares and WinRM, especially where authentication appears legitimate but source systems, timing, or account context are abnormal.
  • Review domain controller monitoring for NTDS access attempts and access to backups containing domain credential material.

Mitigation priorities

  • Confirm asset inventory and remediation status for Palo Alto Networks PAN-OS GlobalProtect systems relevant to CVE-2024-3400.
  • Preserve and review logs from affected or potentially affected edge devices before retention windows expire.
  • Treat confirmed or suspected edge compromise as an identity-risk event: review privileged, VPN, service, and domain account activity and rotate credentials where incident findings justify it.
  • Restrict and monitor administrative paths from edge devices into internal networks, including access that could enable SMB, WinRM, or domain controller interaction.
  • Harden monitoring for Unix shell execution, cron persistence, file transfer, and outbound web/proxy traffic on network devices and supporting Linux systems where telemetry is available.
Additional notes and limits

The decision value of this object is the campaign chain: public-facing appliance exploitation leading to possible backdoor, execution, persistence, C2, collection, credential, and lateral movement concerns. For managed detection and IR, the most important validation is whether telemetry exists at the edge and whether investigations connected appliance events to identity and Windows domain activity.

ATT&CK provides no official detection text for this campaign, and the campaign object itself lists no platforms or tactics. Platform and behavior guidance here is derived from the official description, external references, and supplied relationships only. Local exposure, compromise, and control effectiveness require environment-specific evidence.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Operation MidnightEclipse

Operation MidnightEclipse was a campaign conducted in March and April 2024 that involved initial exploit of zero-day vulnerability CVE-2024-3400, a critical command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

17 rows
DomainIDNameRelationship / procedure
EnterpriseT1005Data from Local System

During Operation MidnightEclipse, threat actors stole saved cookies and login data from targeted systems.[1]

EnterpriseT1078.002Domain AccountsSub-technique

During Operation MidnightEclipse, threat actors used a compromised domain admin account to move laterally.[1]

EnterpriseT1003.003NTDSSub-technique

During Operation MidnightEclipse, threat actors obtained active directory credentials via the NTDS.DIT file.[1]

EnterpriseT1059.004Unix ShellSub-technique

During Operation MidnightEclipse, threat actors piped output from stdout to bash for execution.[1][2]

EnterpriseT1090Proxy

During Operation MidnightEclipse, threat actors used the GO Simple Tunnel reverse proxy tool.[1]

EnterpriseT1559Inter-Process Communication

During Operation MidnightEclipse, threat actors wrote output to stdout then piped it to bash for execution.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

During Operation MidnightEclipse, threat actors used `wget` via HTTP to retrieve payloads.[1][2]

EnterpriseT1078Valid Accounts

During Operation MidnightEclipse, threat actors extracted sensitive credentials while moving laterally through compromised networks.[1]

EnterpriseT1190Exploit Public-Facing Application

During Operation MidnightEclipse, threat actors exploited CVE-2024-3400 in Palo Alto Networks GlobalProtect.[1][2]

EnterpriseT1584.003Virtual Private ServerSub-technique

During Operation MidnightEclipse, threat actors abused Virtual Private Servers to store malicious files.[1]

EnterpriseT1105Ingress Tool Transfer

During Operation MidnightEclipse, threat actors downloaded additional payloads on compromised devices.[1][2]

EnterpriseT1588.002ToolSub-technique

During Operation MidnightEclipse, threat actors used the GO Simple Tunnel (GOST) reverse proxy tool.[1]

EnterpriseT1053.003CronSub-technique

During Operation MidnightEclipse, threat actors configured cron jobs to retrieve payloads from actor-controlled infrastructure.[1][2]

EnterpriseT1021.002SMB/Windows Admin SharesSub-technique

During Operation MidnightEclipse, threat actors used SMB to pivot internally in victim networks.[1]

EnterpriseT1074.001Local Data StagingSub-technique

During Operation MidnightEclipse, threat actors copied files to the web application folder on compromised devices for exfiltration.[2]

EnterpriseT1021.006Windows Remote ManagementSub-technique

During Operation MidnightEclipse, threat actors used WinRM to move laterally in targeted networks.[1]

EnterpriseT1584.006Web ServicesSub-technique

During Operation MidnightEclipse, threat actors abused compromised AWS buckets to store files.[1]

Associated objects

Groups, software, and campaigns

MalwareEnterprise

S1164: UPSTYLE

UPSTYLE is a Python-based backdoor associated with exploitation of Palo Alto firewalls using CVE-2024-3400 in early 2024. UPSTYLE has only been observed in relation to this exploitation activity, which involved attempted install on compromised devices by the threat actor UTA0218.[1][2]

Network DevicesLinux
Relationship explorer

All related ATT&CK context

uses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1078.002: Domain AccountsEnterpriseuses · TechniqueT1003.003: NTDSEnterpriseuses · TechniqueT1059.004: Unix ShellEnterpriseuses · TechniqueT1090: ProxyEnterpriseuses · TechniqueT1559: Inter-Process CommunicationEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · MalwareS1164: UPSTYLEEnterpriseuses · TechniqueT1078: Valid AccountsEnterpriseuses · TechniqueT1190: Exploit Public-Facing ApplicationEnterpriseuses · TechniqueT1584.003: Virtual Private ServerEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1588.002: ToolEnterpriseuses · TechniqueT1053.003: CronEnterpriseuses · TechniqueT1021.002: SMB/Windows Admin SharesEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1021.006: Windows Remote ManagementEnterpriseuses · TechniqueT1584.006: Web ServicesEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
cd9ffb98cd3b5db8...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundlecd9ffb98cd3b…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  2. [2]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  3. [3]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  4. [4]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  5. [5]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  6. [6]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  7. [7]
    mitre-attackC0048
    Open source URL
  8. [8]
    mitre-attackC0048
    Open source URL
  9. [9]
    mitre-attackC0048
    Open source URL
  10. [10]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  11. [11]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  12. [12]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  13. [13]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  14. [14]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  15. [15]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  16. [16]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  17. [17]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  18. [18]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  19. [19]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  20. [20]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  21. [21]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  22. [22]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  23. [23]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  24. [24]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  25. [25]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  26. [26]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  27. [27]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  28. [28]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  29. [29]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  30. [30]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  31. [31]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  32. [32]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  33. [33]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  34. [34]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  35. [35]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  36. [36]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  37. [37]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  38. [38]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  39. [39]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  40. [40]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  41. [41]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  42. [42]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  43. [43]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  44. [44]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  45. [45]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  46. [46]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  47. [47]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  48. [48]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  49. [49]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  50. [50]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  51. [51]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  52. [52]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  53. [53]
    Palo Alto MidnightEclipse APR 2024

    Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.

    Open source URL
  54. [54]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  55. [55]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  56. [56]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  57. [57]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use