NCSC-TAD-2409-001
مستوى الخطورة: منخفضة
برمجيات خبيثة
الرقم المرجعي: NCSC-TAD-2409-001CVSS 0
Fake GlobalProtect VPN Malware Campaign Targets the Middle East
- نوع التهديد:
- غير متوفر
- مستوى المشاركة (TLP):
- CLEAR
- CVE:
- غير متوفر
نظرة عامة
Threat actors distributed malware disguised as the Palo Alto Networks GlobalProtect VPN client to target users in the Middle East. The malware can execute remote PowerShell commands, download and steal files, and communicate with attacker-controlled infrastructure. The initial infection method was not confirmed, although phishing was suspected.
التقنيات المتأثرة
- Palo Alto Networks GlobalProtect
إجراءات الحد من المخاطر والإجراءات الفورية
- 01
Install GlobalProtect only through approved organizational channels and trusted sources.
- 02
Review unusual PowerShell execution, unapproved VPN installations, and connections to suspicious external infrastructure.