MURKY PANDA Exploitation of Internet-Facing Appliances

Maggie Martin@mmartin

•updated Aug 29, 2025•3•2•35

Detects suspicious child processes spawned by Citrix or Commvault services, which may indicate exploitation for initial access (T1190), as seen in MURKY PANDA campaigns involving CVE-2023-3519 and CVE-2025-3928.