Operation MidnightEclipse

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Operation MidnightEclipse was a campaign conducted in March and April 2024 that involved initial exploit of zero-day vulnerability CVE-2024-3400, a critical command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS.(Citation: Volexity UPSTYLE 2024)(Citation: Palo Alto MidnightEclipse APR 2024)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2024-03-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2024-03-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2024-04-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1005 · Data from Local System

  Collection — During Operation MidnightEclipse, threat actors stole saved cookies and login data from targeted systems.(Citation: Volexity UPSTYLE 2024)

• T1078.002 · Domain Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During Operation MidnightEclipse, threat actors used a compromised domain admin account to move laterally.(Citation: Volexity UPSTYLE 2024)

• T1003.003 · NTDS

  Credential Access — During Operation MidnightEclipse, threat actors obtained active directory credentials via the NTDS.DIT file.(Citation: Volexity UPSTYLE 2024)

• T1059.004 · Unix Shell

  Execution — During Operation MidnightEclipse, threat actors piped output from stdout to bash for execution.(Citation: Volexity UPSTYLE 2024)(Citation: Palo Alto MidnightEclipse APR 2024)

• T1090 · Proxy

  Command And Control — During Operation MidnightEclipse, threat actors used the GO Simple Tunnel reverse proxy tool.(Citation: Volexity UPSTYLE 2024)

• T1559 · Inter-Process Communication

  Execution — During Operation MidnightEclipse, threat actors wrote output to stdout then piped it to bash for execution.(Citation: Volexity UPSTYLE 2024)

• T1071.001 · Web Protocols

  Command And Control — During Operation MidnightEclipse, threat actors used `wget` via HTTP to retrieve payloads.(Citation: Volexity UPSTYLE 2024)(Citation: Palo Alto MidnightEclipse APR 2024)

• T1078 · Valid Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During Operation MidnightEclipse, threat actors extracted sensitive credentials while moving laterally through compromised networks.(Citation: Volexity UPSTYLE 2024)

• T1190 · Exploit Public-Facing Application

  Initial Access — During Operation MidnightEclipse, threat actors exploited CVE-2024-3400 in Palo Alto Networks GlobalProtect.(Citation: Volexity UPSTYLE 2024)(Citation: Palo Alto MidnightEclipse APR 2024)

• T1584.003 · Virtual Private Server

  Resource Development — During Operation MidnightEclipse, threat actors abused Virtual Private Servers to store malicious files.(Citation: Volexity UPSTYLE 2024)

• T1105 · Ingress Tool Transfer

  Command And Control — During Operation MidnightEclipse, threat actors downloaded additional payloads on compromised devices.(Citation: Volexity UPSTYLE 2024)(Citation: Palo Alto MidnightEclipse APR 2024)

• T1588.002 · Tool

  Resource Development — During Operation MidnightEclipse, threat actors used the GO Simple Tunnel (GOST) reverse proxy tool.(Citation: Volexity UPSTYLE 2024)

• T1053.003 · Cron

  Execution, Persistence, Privilege Escalation — During Operation MidnightEclipse, threat actors configured cron jobs to retrieve payloads from actor-controlled infrastructure.(Citation: Volexity UPSTYLE 2024)(Citation: Palo Alto MidnightEclipse APR 2024)

• T1021.002 · SMB/Windows Admin Shares

  Lateral Movement — During Operation MidnightEclipse, threat actors used SMB to pivot internally in victim networks.(Citation: Volexity UPSTYLE 2024)

• T1074.001 · Local Data Staging

  Collection — During Operation MidnightEclipse, threat actors copied files to the web application folder on compromised devices for exfiltration.(Citation: Palo Alto MidnightEclipse APR 2024)

• T1021.006 · Windows Remote Management

  Lateral Movement — During Operation MidnightEclipse, threat actors used WinRM to move laterally in targeted networks.(Citation: Volexity UPSTYLE 2024)

• T1584.006 · Web Services

  Resource Development — During Operation MidnightEclipse, threat actors abused compromised AWS buckets to store files.(Citation: Volexity UPSTYLE 2024)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0048

  Official MITRE ATT&CK campaign record C0048. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.