Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution Unit 42 details CVE-2026-0300, a buffer overflow vulnerability in the PAN-OS User-ID Authentication Portal. Read now for details. The post Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution appeared first on Unit 42 . Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution Me…

https://unit42.paloaltonetworks.com/captive-portal-zero-day

sha256:9495d60b4df41894492a6f739e06d5be4e6ee26a6a16b6750af063853967ac77

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve12
md50
url0
ipv45
ipv60
sha10
domain2
sha2561
malware_token1
attack_pattern2
threat_actor_token1

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	github.com	Open →
ip	67.206.213.86	Open →
ip	136.0.8.48	Open →
ip	146.70.100.69	Open →
ip	149.104.66.84	Open →
ip	138.0.0.0	Open →
domain	reversesocks5-v2.2.0-linux-amd64.tar.gz

Malware families

Allowlist token matches only.

Cobalt Strikemalware-family

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

APT41

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports