Skip to main content
عربي
logo

NCSC-TAD-2409-001

Severity Level: Low
Malware

Reference No.: NCSC-TAD-2409-001CVSS 0

Fake GlobalProtect VPN Malware Campaign Targets the Middle East

Threat Type:
N/A
TLP:
CLEAR
CVE:
N/A

Overview

Threat actors distributed malware disguised as the Palo Alto Networks GlobalProtect VPN client to target users in the Middle East. The malware can execute remote PowerShell commands, download and steal files, and communicate with attacker-controlled infrastructure. The initial infection method was not confirmed, although phishing was suspected.

Affected Technologies

  • Palo Alto Networks GlobalProtect

Mitigation and Immediate Actions

  1. 01

    Install GlobalProtect only through approved organizational channels and trusted sources.

  2. 02

    Review unusual PowerShell execution, unapproved VPN installations, and connections to suspicious external infrastructure.

References