CL-STA-1132
CL-STA-1132 is a threat activity cluster tracked by Palo Alto Networks Unit 42 and assessed in the provided reporting as likely state-sponsored or state-linked, with unknown provenance. Unit 42 attributed observed exploitation of CVE-2026-0300 to this cluster. The activity centered on exploitation of the critical PAN-OS User-ID Authentication Portal (Captive Portal) vulnerability CVE-2026-0300 to achieve unauthenticated remote code execution and root-level access on exposed PA-Series and VM-Series firewalls, particularly internet-exposed or untrusted-zone-accessible Authentication Portal instances. Reported post-exploitation tradecraft included injecting shellcode into an nginx worker process, executing arbitrary commands on compromised firewalls, deleting logs, crash artifacts, core dumps, and other forensic evidence, and maintaining low-noise access through intermittent interactive sessions over multiple weeks. The cluster reportedly used open-source tooling rather than custom malware, including EarthWorm and ReverseSocks5 for tunneling/proxying, and favored memory-based execution and native system capabilities. Reported follow-on activity included credential theft from compromised firewalls, Active Directory enumeration using likely stolen or firewall-linked service account credentials, internal pivoting, and use of tunneling to support command and control and lateral movement. One report also states the attackers triggered SAML floods to force high-availability failover and repeat the intrusion chain on secondary firewalls. The campaign is described as focused on enterprise perimeter infrastructure, critical infrastructure, and high-value enterprise networks, with an espionage-oriented emphasis on stealth, persistence, and long-term access rather than disruptive effects. The content notes attempted exploitation as early as 2026-04-09, successful compromise about a week later in at least one case, and limited but active in-the-wild exploitation observed around disclosure. No aliases or sub-groups beyond the tracking name CL-STA-1132 are provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
20 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Associated vulnerabilities
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
Observables
6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Observed exploiting CVE-2026-0300 in PAN-OS User-ID Authentication Portal to gain pre-auth root access on internet-exposed firewalls, then using the compromised firewall as a pivot point into internal networks.
State-sponsored threat cluster conducting targeted exploitation of Palo Alto PAN-OS edge infrastructure for stealthy long-term access, espionage, credential theft, and lateral movement.
Likely state-sponsored activity cluster exploiting the PAN-OS zero-day CVE-2026-0300 to gain unauthenticated remote code execution on exposed firewalls, inject shellcode into nginx worker processes, deploy tunneling tools, enumerate Active Directory with stolen credentials, and destroy logs to hide compromise.
A likely state-sponsored activity cluster exploiting CVE-2026-0300 in PAN-OS to gain unauthenticated remote code execution with root privileges on exposed firewalls, inject shellcode into nginx worker processes, erase forensic evidence, deploy tunneling tools for outbound C2, enumerate Active Directory, and trigger SAML floods to force HA failover and repeat compromise on secondary firewalls.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.