Last observed
Campaign
Operation MidnightEclipse last observed
The campaign source marks this as the latest known activity date.
MITRE ATT&CKSource
ActiveMITRE ATT&CK
Operation MidnightEclipse
Operation MidnightEclipse was a campaign conducted in March and April 2024 that involved initial exploit of zero-day vulnerability CVE-2024-3400, a critical command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS.
First observedMar 1, 2024
Last observedApr 1, 2024
Attributed actors0
Source-backed events2
Attribution
Who has been linked to this activity
Each relationship retains its own confidence and source.
No actor attribution is currently available.
Activity
Campaign timeline
Every date says what it measures so catalog dates are not confused with publication dates.
First observed
Campaign
Operation MidnightEclipse first observed
The campaign source marks this as the beginning of the known activity window.
MITRE ATT&CKSource
About the context below
CVEs, techniques, malware, and indicators in the sections below are associated with an attributed actor. They are useful investigative context, but the campaign source does not necessarily link every item directly to this campaign.
Investigation context
What the attributed actors are known to use
Use this material to guide hunting and prioritization, then confirm each relationship against its cited source.
Related vulnerabilities 0
No linked CVEs are available.
ATT&CK techniques 0
No linked techniques are available.
Malware and tools 0
No linked malware or tools are available.
Indicators 0
No source-linked indicators are available.
Sources
Evidence behind this page
Open the original material before making an attribution or response decision.