Palo Alto Networks zero-day exploited since March to backdoor firewalls

Suspected state-sponsored hackers have been exploiting a zero-day vulnerability in Palo Alto Networks firewalls since March to breach internal networks and steal data. The vulnerability is tracked as CVE-2024-3400. Palo Alto Networks has released mitigations and patches on April 14. The threat actors have been using a custom backdoor named 'Upstyle' to execute commands on compromised devices. Detecting a compromised Palo Alto Networks firewall can be done by generating a Tech Support File or monitoring network activity.