Dream: AI-assisted campaign roots 25 PAN-OS firewalls

The operation stands out less for a novel vulnerability than for the preparation behind it. According to Dream, the attacker obtained PAN-OS firmware, decrypted it, extracted the PHP libraries and built 11 JSON version profile files, one for each PAN-OS version tested, complete with offsets, SHA256 hashes and memory geometry parameters tuned through lab testing. That investment let the exploitation itself run as an automated batch against 240 targets, five at a time with a 30-minute timeout per target.

The targeting funnel was equally deliberate. FOFA surfaced roughly 19,000 exposed management interfaces; a 200-thread scanner cut that to about 5,000 live devices reporting version information; geographic and version filtering reduced it to 240. Dream notes that the four countries selected are the primary strategic adversaries and intelligence targets for Chinese state-aligned operations in the Pacific theater, which it says indicates potential nation-state adversary efforts, while adding that it does not attribute the activity to a named threat actor. Palo Alto Networks' Unit 42 tracks it as CL-UNK-1280 and attributes it to a Chinese-speaking attacker in the UTC+8 time zone.

What Dream could not recover is the result of the later stages. The password spray against every domain user, the attempts to create backdoor user and machine accounts, and the SAML signing key extraction all ran from the management server, but their outputs stayed on that server's local filesystem and were not among the artifacts. Dream states plainly that it cannot determine the full extent of the compromise, and that the persistent tunnel and root webshells are likely still active.