UPSTYLE — Malware Profile
UPSTYLE is a Python-based backdoor associated with exploitation of Palo Alto firewalls using CVE-2024-3400 in early 2024. UPSTYLE has only been observed in relation to this exploitation activity, which involved attempted install on compromised devices by the threat actor UTA0218.
MITRE ATT&CK techniques (12)
- T1001.001 Junk Data
- T1027.013 Encrypted/Encoded File
- T1036 Masquerading
- T1057 Process Discovery
- T1059.006 Python
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1102.003 One-Way Communication
- T1140 Deobfuscate/Decode Files or Information
- T1546 Event Triggered Execution
- T1665 Hide Infrastructure
- T1685.006 Clear Linux or Mac System Logs