Procedure

exploit-escalation:try-newer-then-pivot

2 campaigns

Feng Shui: A Custom, Fully-Obfuscated Sliver Implant Deployed to a Palo Alto Firewall (CVE-2024-0012 + CVE-2024-9474)

Over two days we watched a single operator chain two PAN-OS vulnerabilities in one request to install a custom-compiled, fully-obfuscated Sliver implant that appears in no public malware database and beacons to domains absent from every threat feed. A step-by-step walkthrough of the intrusion, with deployable Sigma and YARA detection.

2026-07-09

FortiGate Admin-Hijack Operator Plants Hidden Backdoors and Steals Full Device Configuration

A skilled operator used CVE-2022-40684 to take over an internet-facing FortiGate through its REST API: six backdoor super-admin accounts, an SSH key for re-entry, the admin account hidden from the GUI, MFA disabled, and the full configuration stolen. No malware.

2026-06-09