Hackers Exploit Cortex XDR Live Terminal For C2 Communications, Compromising ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cortex XDR Live Terminal Vulnerability Enables C2 Exploitation Research has revealed that attackers can exploit the Cortex XDR Live Terminal feature from Palo Alto Networks to establish command-and-control (C2) communications. This feature operates within a trusted endpoint detection and response (EDR) agent, allowing malicious traffic to bypass many enterprise security measures. Organizations utilizing Cortex XDR may be at risk of undetected cyber operations. 3 sources 26