JA4H Fingerprinting Detects Sliver C2 Deployed via Chained PAN-OS CVE-2024-0012/CVE-2024-9474 Exploitation
JA4H Fingerprinting Detects Sliver C2 Deployed via Chained (TL-2026-2144), also tracked as Operation Lunar Peek, is a high-severity malware campaign scored CVSS 9.8, first published 2026-08-25. It has no confirmed attribution, affects Palo Alto Networks PAN-OS, references 2 CVEs (CVE-2024-0012, CVE-2024-9474), maps to 9 MITRE ATT&CK techniques (T1005, T1021, T1059.004), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-2144
- Threat ID
- TL-2026-2144
- Also known as
- Operation Lunar Peek
- Severity
- HIGH
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-25
- Last reviewed
- 2026-08-25
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in JA4H Fingerprinting Detects Sliver C2 Deployed via Chained
Malware and tooling: Spectre Rat, Sliver - S0633
Threat actors chained an unauthenticated PAN-OS management-interface authentication bypass (CVE-2024-0012, CVSS 9.8) with a command-injection privilege-escalation flaw (CVE-2024-9474, CVSS 7.2) to gain root on Palo Alto Networks firewalls and deploy the open-source Sliver C2 framework in its default configuration. Researchers used JA4H HTTP client fingerprinting to identify the unencrypted Sliver traffic, recovering distinct fingerprints, two C2 IP addresses, and Sliver's default cookie names and TLS certificate CNs.
How JA4H Fingerprinting Detects Sliver C2 Deployed via Chained works
On November 18, 2024, Palo Alto Networks disclosed CVE-2024-0012, a missing-authentication vulnerability (CWE-306) in the PAN-OS management web interface that lets an unauthenticated network attacker obtain administrator privileges, and CVE-2024-9474, an OS command-injection flaw (CWE-78) that lets an authenticated administrator escalate to root. Palo Alto stated it had already identified a limited number of exploitation attempts against management interfaces at disclosure time. On November 19, 2024, watchTowr Labs published the technical mechanics of chaining the two bugs into unauthenticated remote code execution: appending a `/.js.map` or `/aaaa.js.map` suffix to a request path (e.g. `GET /php/ztp_gate.php/.js.map` with header `X-PAN-AUTHCHECK: off`) bypasses PAN-OS's authcheck enforcement because the underlying Nginx configuration only reset that header on specific routes; the attacker then POSTs a forged `user` parameter containing a backtick command substitution to `/php/utils/createRemoteAppwebSession.php`, which is later executed with root privileges when `AuditLog.php` shells out via `pan_elog` using the unsanitized username.
Within hours of the watchTowr writeup, Arctic Wolf Labs observed active in-the-wild exploitation, and Palo Alto Networks' Unit 42 tracked the resulting activity as "Operation Lunar Peek," attributing early scanning/exploitation traffic to IP space associated with anonymous VPN services but stopping short of actor attribution. Observed post-exploitation behavior included transferring obfuscated PHP web shells onto compromised firewalls, running interactive commands, exfiltrating configuration files, and — as the campaign matured over the following days — dropping an increasingly diverse set of payloads via `curl`/`wget`, including the open-source Sliver C2 framework (an alternative to Cobalt Strike, developed by Bishop Fox), cryptocurrency miners, and (per Darktrace's telemetry on the broader campaign) the Spectre RAT and additional PHP web shells, alongside attempted lateral movement over SMB/SSH.
On November 26-28, 2024, FoxIO's John Althouse and the Webscout research team analyzed a Sliver deployment left in its default configuration and used JA4H — a JA4+ suite fingerprint of the HTTP client derived from method/headers/cookies — to distinguish Sliver's stock HTTP C2 traffic from legitimate traffic. Because the operators never customized Sliver's default HTTP profile, the traffic exposed a stable, low-header-count fingerprint, default cookie names (`SSID`, `refreshToken`, `csrf-state`), a default listener on TCP/31337, and self-signed TLS certificates with Issuer CN="operators" / Subject CN="multiplayer" — all artifacts of an un-hardened Sliver install rather than of the PAN-OS vulnerabilities themselves. This entry documents the exploit chain used for initial access and the JA4H-based detection technique used to surface the resulting Sliver C2 activity; CVE-2024-0012 and CVE-2024-9474 were added to the CISA Known Exploited Vulnerabilities catalog on 2024-12-03 with a 2024-12-09 remediation deadline.
MITRE ATT&CK techniques used in TL-2026-2144
Collection
Lateral Movement
Execution
Command and Control
T1071.001 Web Protocols; T1571 Non-Standard Port
Discovery
T1082 System Information Discovery
Initial Access
T1190 Exploit Public-Facing Application
Impact
Persistence
Affected products and versions in JA4H Fingerprinting Detects Sliver C2 Deployed via Chained
- Palo Alto Networks — PAN-OS
Vulnerable versions: 10.1.0-10.1.14-h5; 10.2.0-10.2.12-h1; 11.0.0-11.0.6; 11.1.0-11.1.5; 11.2.0-11.2.4
Fixed in: 10.1.14-h6; 10.2.12-h2; 11.0.6-h1; 11.1.5-h1; 11.2.4-h1 - Palo Alto Networks — PA-Series, VM-Series, CN-Series firewalls and Panorama (virtual and M-Series)
Vulnerable versions: all PAN-OS versions above with internet-exposed management interface
Fixed in: Cloud NGFW and Prisma Access are unaffected
Remediation for JA4H Fingerprinting Detects Sliver C2 Deployed via Chained
Patches
- PAN-OS 10.1.14-h6
- PAN-OS 10.2.12-h2
- PAN-OS 11.0.6-h1
- PAN-OS 11.1.5-h1
- PAN-OS 11.2.4-h1
Immediate actions
- Restrict the PAN-OS management web interface to trusted internal IP addresses; do not expose it to the internet
- Apply Palo Alto Threat Prevention IDs 95746, 95747, 95752, 95753, 95759, 95763 (requires Applications and Threats content v8915-9075 or later)
- Hunt HTTP/TLS traffic for JA4H fingerprint prefix po11cn050000_bb52516416a2_*, connections to TCP/31337, and TLS certificates with Issuer CN=operators / Subject CN=multiplayer
- Review firewall management-interface logs for requests containing a .js.map path suffix combined with the X-PAN-AUTHCHECK: off header
Workarounds
- Restrict management interface access to trusted internal IP addresses per Palo Alto best-practice deployment guidelines
- Disable internet-facing exposure of the management web interface
Longer-term hardening
- Patch PAN-OS to the fixed releases (10.1.14-h6+, 10.2.12-h2+, 11.0.6-h1+, 11.1.5-h1+, 11.2.4-h1+) or later maintenance releases
- Route management access exclusively through jump boxes or a dedicated dataplane management interface, never directly on the internet
- Deploy JA4H-capable, packet-level network detection — NetFlow metadata alone cannot distinguish default Sliver HTTP traffic from benign traffic
CVEs associated with JA4H Fingerprinting Detects Sliver C2 Deployed via Chained
CVE-2024-0012, CVE-2024-9474
Weaknesses (CWE) in JA4H Fingerprinting Detects Sliver C2 Deployed via Chained
CWE-306, CWE-78
Timeline of JA4H Fingerprinting Detects Sliver C2 Deployed via Chained
- Palo Alto Networks discloses CVE-2024-0012 (auth bypass, CVSS 9.8) and CVE-2024-9474 (privilege escalation, CVSS 7.2) and reports having already identified a limited number of exploitation attempts against management interfaces.
- watchTowr Labs publishes the technical exploit chain (X-PAN-AUTHCHECK header bypass via .js.map path suffix plus AuditLog.php command injection); Arctic Wolf begins observing active in-the-wild exploitation hours later.
- Arctic Wolf Labs publishes a bulletin documenting attackers using curl/wget on compromised firewalls to pull down payloads over HTTP.
- Palo Alto Networks Unit 42 issues its last update to the "Operation Lunar Peek" threat brief, reporting obfuscated PHP web shell deployment, interactive command execution, and increasing payload diversity.
- FoxIO's John Althouse shares JA4H fingerprints for identifying the default-configuration Sliver C2 HTTP traffic on the affected firewalls.
- Webscout publishes "Dissecting JA4H for improved Sliver C2 detections," detailing Sliver's exposed default cookie names, TLS certificate CNs, TCP/31337 listener, and two C2 IP addresses.
- CISA adds CVE-2024-0012 and CVE-2024-9474 to the Known Exploited Vulnerabilities catalog with a remediation due date of 2024-12-09.
- CISA's KEV remediation deadline for federal agencies passes; Darktrace separately publishes its own analysis of the broader "Operation Lunar Peek" post-exploitation activity across its customer telemetry.
Sources cited for JA4H Fingerprinting Detects Sliver C2 Deployed via Chained
- Dissecting JA4H for improved Sliver C2 detections
- Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
- Follow-Up: Arctic Wolf Observes Ongoing Exploitation of Critical Palo Alto Networks Vulnerability CVE-2024-0012 Chained with CVE-2024-9474
- Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012 and CVE-2024-9474
- Darktrace's view on Operation Lunar Peek: Exploitation of Palo Alto firewall devices
- CVE-2024-0012 Security Advisory
- CVE-2024-9474 Security Advisory
- CISA Adds Three Known Exploited Vulnerabilities to Catalog
More in malware
- MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana Blockchain for C2
- AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and PROMPTSTEAL/LAMEHUG (APT28)
- EtherHiding / Blockchain Dead Drops: Nation-State Actors Drive 440% Surge in On-Chain Malware C2
- KREMLIN Banking Malware Forges Chrome/Edge Secure Preferences Integrity Checks to Force-Install Malicious 'AVSync' Extension
- Iranian State Actors Deploy CHOSEN BRICK Windows Malware to Spy on Dissidents, Activists, and Journalists
Detection coverage for TL-2026-2144
As of 2026-08-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2144 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.