Loading threat actor…
CL-STA-1132 is a suspected state-sponsored threat cluster tracked by Unit 42 for exploitation of CVE-2026-0300, a critical pre-authentication remote code execution vulnerability in the PAN-OS User-ID Authentication Portal (Captive Portal). The activity focused on internet-exposed PA-Series and VM-Series firewall infrastructure and achieved unauthenticated root-level compromise of affected edge devices. Observed tradecraft indicates an espionage-oriented intrusion set emphasizing stealth, persistence, and long-term access to perimeter infrastructure rather than disruptive or destructive effects. Post-exploitation behavior attributed to CL-STA-1132 includes shellcode injection into an nginx worker process, execution of arbitrary commands on compromised firewalls, credential access, Active Directory enumeration using credentials likely obtained from the firewall, internal pivoting, and covert tunneling through open-source proxy and port-forwarding tools including EarthWorm and ReverseSocks5. The cluster has been described as favoring memory-resident execution, native system capabilities, and intermittent interactive sessions over custom malware deployment, reducing signature-based detection opportunities and helping maintain a low-noise operational profile. The actor also demonstrated deliberate defense evasion and anti-forensics. Reported actions include deletion of crash artifacts, core dumps, nginx crash records, logs, and other evidence of compromise to hinder forensic reconstruction. Reporting further indicates abuse of identity trust relationships for lateral movement and, in at least one case, SAML-flood activity intended to force high-availability failover so the intrusion chain could be repeated against a secondary firewall. The cluster’s provenance remains publicly unresolved, but the activity has been assessed as likely state-sponsored. No confirmed country attribution is available at high confidence. Known aliases are limited to the tracking designation CL-STA-1132.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
20 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Observed exploiting CVE-2026-0300 in PAN-OS User-ID Authentication Portal to gain pre-auth root access on internet-exposed firewalls, then using the compromised firewall as a pivot point into internal networks.
State-sponsored threat cluster conducting targeted exploitation of Palo Alto PAN-OS edge infrastructure for stealthy long-term access, espionage, credential theft, and lateral movement.
Likely state-sponsored activity cluster exploiting the PAN-OS zero-day CVE-2026-0300 to gain unauthenticated remote code execution on exposed firewalls, inject shellcode into nginx worker processes, deploy tunneling tools, enumerate Active Directory with stolen credentials, and destroy logs to hide compromise.
A likely state-sponsored activity cluster exploiting CVE-2026-0300 in PAN-OS to gain unauthenticated remote code execution with root privileges on exposed firewalls, inject shellcode into nginx worker processes, erase forensic evidence, deploy tunneling tools for outbound C2, enumerate Active Directory, and trigger SAML floods to force HA failover and repeat compromise on secondary firewalls.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.