The Curious Engineer

All blogs / Security

Unit 42

unit42.paloaltonetworks.com

Unit 42 brings together world-renowned threat researchers, incident responders and security consultants to create an intelligence-driven, response-ready organization that's passionate about helping you proactively manage cyber risk.

Security

’15’20’25
Posts
1,245 from 12 Apr 2014 to 28 Oct 2026
Posting
weekly (134 in the last year)
Kind
company blog
Feed
https://unit42.paloaltonetworks.com/feed/

2026 118

  1. Unwrapping Retail Peak Season Cyber Threats
  2. Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25)
  3. EMudhra Intermediate CA Certificates Compromised
  4. The Current Landscape of OAuth Attacks
  5. “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities
  6. Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)
  7. Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026
  8. AI-Powered Espionage Campaign Targets Government Linux Infrastructure
  9. Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
  10. The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk
  11. Evolution of Web3 in Cloud Supply Chain Attacks
  12. Blinder Tunnel Campaign Targets Iraqi Infrastructure
  13. Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
  14. OperTraitors: How Kubernetes Operators Betray Your Security Posture
  15. 3 Consulting Myths Debunked by Unit 42 Experts
  16. From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies
  17. A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity
  18. Inside the Modern SOC: Defending the Cross-Environment Pivot
  19. Atomic macOS (AMOS) Stealer Activity
  20. Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection
  21. The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE
  22. Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure
  23. Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America
  24. An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation
  25. Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
  26. Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety
  27. The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution
  28. Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain
  29. Identity Abuse Through Trusted Communication Channels
  30. Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)
  31. Kimwolf v7: An Evolution of the Kimwolf Botnet
  32. The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications
  33. Inside the Modern SOC: The Identity Front Door
  34. ChainDrop: Inside a Self-Propagating npm Worm
  35. Token Jacking: Cybercriminals Could Be Stealing Your AI Resources
  36. The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software
  37. Almost Half of Malware Samples Communicate Direct to IP
  38. Pass the Passkey: A Novel Attack Surface in Passwordless Authentication
  39. The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version
  40. Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
  41. Russian Global Webmail Espionage
  42. Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy
  43. AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report
  44. The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)
  45. TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development
  46. No Manners Here: The Ruthless Rise of The Gentlemen Ransomware
  47. Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation
  48. How We Added WebAuthn to a Browser-Based RDP Client
  49. Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector
  50. CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure
  51. OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat
  52. The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration
  53. Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE
  54. Inside the Modern SOC: The 72-Minute Race
  55. Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered
  56. Trust No Skill: Integrity Verification for AI Agent Supply Chains
  57. Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility
  58. When “Hi, This Is IT” Comes Through Microsoft Teams
  59. Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor
  60. 2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface
  61. Out of the Crypt: The Evolving Cyber Extortion Economy
  62. Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns
  63. Paved With Intent: ROADtools and Nation-State Tactics in the Cloud
  64. Tracking TamperedChef Clusters via Certificate and Code Reuse
  65. Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files
  66. Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools
  67. Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution
  68. Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years
  69. Essential Data Sources for Detection Beyond the Endpoint
  70. That AI Extension Helping You Write Emails? It’s Reading Them First
  71. TGR-STA-1030: New Activity in Central and South America
  72. Frontier AI and the Future of Defense: Your Top Questions Answered
  73. Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System
  74. When Wi-Fi Encryption Fails: Protecting Your Enterprise from AirSnitch Attacks
  75. Fracturing Software Security With Frontier AI Models
  76. Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)
  77. A Deep Dive Into Attempted Exploitation of CVE-2023-33538
  78. Cracks in the Bedrock: Agent God Mode
  79. Cracks in the Bedrock: Escaping the AWS AgentCore Sandbox
  80. Understanding Current Threats to Kubernetes Environments
  81. When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi-Agent Applications
  82. Threat Brief: Widespread Impact of the Axios Supply Chain Attack
  83. Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure
  84. Double Agents: Exposing Security Blind Spots in GCP Vertex AI
  85. Converging Interests: Analysis of Threat Clusters Targeting a Southeast Asian Government
  86. Threat Brief: Recruiting Scheme Impersonating Palo Alto Networks Talent Acquisition Team
  87. Google Cloud Authenticator: The Hidden Mechanisms of Passwordless Authentication
  88. Who’s Really Shopping? Retail Fraud in the Age of Agentic AI
  89. Analyzing the Current State of AI Use in Malware
  90. Navigating Security Tradeoffs of AI Agents
  91. Open, Closed and Broken: Prompt Fuzzing Finds LLMs Still Fragile Across Open and Closed Models
  92. Boggy Serpens Threat Assessment
  93. Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization
  94. Insights: Increased Risk of Wiper Attacks
  95. Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia
  96. Auditing the Gatekeepers: Fuzzing "AI Judges" to Bypass Security Controls
  97. An Investigation Into Years of Undetected Operations Targeting High-Value Sectors
  98. Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild
  99. Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini Panel
  100. Bring the Fight to the Edge: Turning Time Into an Advantage in OT Security
  101. VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)
  102. Critical Vulnerabilities in Ivanti EPMM Exploited
  103. Phishing on the Edge of the Web and Mobile Using QR Codes
  104. Nation-State Actors Exploit Notepad++ Supply Chain
  105. A Peek Into Muddled Libra’s Operational Playbook
  106. Novel Technique to Detect Cloud Threat Actor Operations
  107. The Shadow Campaigns: Uncovering Global Espionage
  108. Why Smart People Fall For Phishing Attacks
  109. Privileged File System Vulnerability Present in a SCADA System
  110. Understanding the Russian Cyberthreat to the 2026 Winter Olympics
  111. Happy 9th Anniversary, CTA: A Celebration of Collaboration in Cyber Defense
  112. The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time
  113. DNS OverDoS: Are Private Endpoints Too Private?
  114. Anatomy of an Attack: The Payroll Pirates and the Power of Social Engineering
  115. Threat Brief: MongoDB Vulnerability (CVE-2025-14847)
  116. Remote Code Execution With Modern AI/ML Formats and Libraries
  117. Securing Vibe Coding Tools: Scaling Productivity Without Scaling Risk
  118. VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion

2025 115

  1. Who Does Cybersecurity Need? You!
  2. From Linear to Complex: An Upgrade in RansomHouse Encryption
  3. Stay Secure: Why Cyber Hygiene Should Be Part of Your Personal Hygiene
  4. Exploitation of Critical Vulnerability in React Server Components (Updated December 12)
  5. Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite
  6. 01flip: Multi-Platform Ransomware Written in Rust
  7. New Prompt Injection Attack Vectors Through MCP Sampling
  8. The Browser Defense Playbook: Stopping the Attacks That Start on Your Screen
  9. The Golden Scale: 'Tis the Season for Unwanted Gifts
  10. "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26)
  11. The Dual-Use Dilemma of AI: Malicious LLMs
  12. Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT
  13. You Thought It Was Over? Authentication Coercion Keeps Evolving
  14. LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices
  15. Know Ourselves Before Knowing Our Enemies: Threat Intelligence at the Expense of Asset Management
  16. Microsoft WSUS Remote Code Execution (CVE-2025-59287) Actively Exploited in the Wild (Updated November 3)
  17. When AI Agents Go Rogue: Agent Session Smuggling Attack in A2A Systems
  18. Suspected Nation-State Threat Actor Uses New Airstalk Malware in a Supply Chain Attack
  19. Bots, Bread and the Battle for the Web
  20. Cloud Discovery With AzureHound
  21. The Smishing Deluge: China-Based Campaign Flooding Global Text Messages
  22. Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign
  23. The Golden Scale: Notable Threat Updates and Looking Ahead
  24. Threat Brief: Nation-State Actor Steals F5 Source Code and Undisclosed Vulnerabilities
  25. PhantomVAI Loader Delivers a Range of Infostealers
  26. Anatomy of an Attack: The "BlackSuit Blitz" at a Global Equipment Manufacturer
  27. The Golden Scale: Bling Libra and the Evolving Extortion Economy
  28. When AI Remembers Too Much – Persistent Behaviors in Agents’ Memory
  29. The ClickFix Factory: First Exposure of IUAM ClickFix Generator
  30. Responding to Cloud Incidents: A Step-by-Step Guide From the 2025 Unit 42 Global Incident Response Report
  31. TOTOLINK X6000R: Three New Vulnerabilities Uncovered
  32. Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite
  33. Threat Insights: Active Exploitation of Cisco ASA Zero Days
  34. Bookworm to Stately Taurus Using the Unit 42 Attribution Framework
  35. Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign
  36. Myth Busting: Why "Innocent Clicks" Don't Exist in Cybersecurity
  37. The Risks of Code Assistant LLMs: Harmful Content, Misuse and Deception
  38. Trusted Connections, Hidden Risks: Token Management in the Third-Party Supply Chain
  39. AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks
  40. Data Is the New Diamond: Latest Moves by Hackers and Defenders
  41. Model Namespace Reuse: An AI Supply-Chain Attack Exploiting Model Name Trust
  42. Why Threat Intelligence: A Conversation With Unit 42 Interns
  43. Threat Brief: Salesloft Drift Integration Used To Compromise Salesforce Instances
  44. Data Is the New Diamond: Heists in the Digital Age
  45. Insights: Telling You What We Really Think
  46. Your Connection, Their Cash: Threat Actors Misuse SDKs to Sell Your Bandwidth
  47. Logit-Gap Steering: A New Frontier in Understanding and Probing LLM Safety
  48. Fashionable Phishing Bait: GenAI on the Hook
  49. A Mega Malware Analysis Tutorial Featuring Donut-Generated Shellcode
  50. Muddled Libra’s Strike Teams: Amalgamated Evil
  51. Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild
  52. New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer
  53. Muddled Libra: Why Are We So Obsessed With You?
  54. When Good Accounts Go Bad: Exploiting Delegated Managed Service Accounts in Active Directory
  55. Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
  56. Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)
  57. Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
  58. Introducing Unit 42’s Attribution Framework
  59. 2025 Unit 42 Global Incident Response Report: Social Engineering Edition
  60. The Covert Operator's Playbook: Infiltration of Global Telecom Networks
  61. The Ηоmоgraph Illusion: Not Everything Is As It Seems
  62. Muddled Libra Threat Assessment: Further-Reaching, Faster, More Impactful
  63. Cloud Logging for Security and Beyond
  64. Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication
  65. Evolving Tactics of SLOW#TEMPEST: A Deep Dive Into Advanced Malware Techniques
  66. Fix the Click: Preventing the ClickFix Attack Vector
  67. GoldMelody’s Hidden Chords: Initial Access Broker In-Memory IIS Modules Revealed
  68. Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack
  69. Windows Shortcut (LNK) Malware Strategies
  70. Threat Brief: Escalation of Cyber Risk Related to Iran (Updated June 30)
  71. Cybercriminals Abuse Open-Source Tools To Target Africa’s Financial Sector
  72. Resurgence of the Prometei Botnet
  73. Exploring a New KimJongRAT Stealer Variant and Its PowerShell Implementation
  74. Serverless Tokens in the Cloud: Exploitation and Detections
  75. JSFireTruck: Exploring Malicious JavaScript Using JSF*ck as an Obfuscation Technique
  76. The Evolution of Linux Binaries in Targeted Cloud Operations
  77. Roles Here? Roles There? Roles Anywhere: Exploring the Security of AWS IAM Roles Anywhere
  78. Blitz Malware: A Tale of Game Cheats and Code Repositories
  79. Lost in Resolution: Azure OpenAI's DNS Resolution Issue
  80. How Good Are the LLM Guardrails on the Market? A Comparative Study on the Effectiveness of LLM Content Filtering Across Major GenAI Platforms
  81. Threat Brief: CVE-2025-31324 (Updated June 25)
  82. Threat Group Assessment: Muddled Libra (Updated May 16, 2025)
  83. DarkCloud Stealer: Comprehensive Analysis of a New Attack Chain That Employs AutoIt
  84. Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources
  85. Iranian Cyber Actors Impersonate Model Agency in Suspected Espionage Operation
  86. Lampion Is Back With ClickFix Lures
  87. AI Agents Are Here. So Are the Threats.
  88. Gremlin Stealer: New Stealer on Sale in Underground Forum
  89. Extortion and Ransomware Trends January-March 2025
  90. False Face: Unit 42 Demonstrates the Alarming Ease of Synthetic Identity Creation
  91. Cascading Shadows: An Attack Chain Approach to Avoid Detection and Complicate Analysis
  92. Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware
  93. How Prompt Attacks Exploit GenAI and How to Fight Back
  94. OH-MY-DC: OIDC Misconfigurations in CI/CD
  95. Evolution of Sophisticated Phishing Tactics: The QR Code Phenomenon
  96. Cloud Threats on the Rise: Alert Trends Show Intensified Attacker Focus on IAM, Exfiltration
  97. GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment (Updated 4/2)
  98. Off the Beaten Path: Recent Unusual Malware
  99. Investigating Scam Crypto Investment Platforms Using Pyramid Schemes to Defraud Victims
  100. Multiple Vulnerabilities Discovered in a SCADA System
  101. The Next Level: Typo DGAs Used in Malicious Redirection Chains
  102. Beneath the Surface: Detecting and Blocking Hidden Malicious Traffic Distribution Systems
  103. Uncovering .NET Malware Obfuscated by Encryption and Virtualization
  104. JavaGhost’s Persistent Phishing Attacks From the Cloud
  105. Squidoor: Suspected Chinese Threat Actor’s Backdoor Targets Global Organizations
  106. RustDoor and Koi Stealer for macOS Used by North Korea-Linked Threat Actor to Target the Cryptocurrency Sector
  107. Auto-Color: An Emerging and Evasive Linux Backdoor
  108. Investigating LLM Jailbreaking of Popular Generative AI Web Products
  109. Stately Taurus Activity in Southeast Asia Links to Bookworm Malware
  110. Multiple Vulnerabilities Discovered in NVIDIA CUDA Toolkit
  111. Stealers on the Rise: A Closer Look at a Growing macOS Threat
  112. Recent Jailbreaks Demonstrate Emerging Threat to DeepSeek
  113. CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia
  114. Threat Brief: CVE-2025-0282 and CVE-2025-0283 (Updated March 11)
  115. One Step Ahead in Cyber Hide-and-Seek: Automating Malicious Infrastructure Discovery With Graph Neural Networks

2024 93

  1. Bad Likert Judge: A Novel Multi-Turn Technique to Jailbreak LLMs by Misusing Their Evaluation Capability
  2. Now You See Me, Now You Don’t: Using LLMs to Obfuscate Malicious JavaScript
  3. Effective Phishing Campaign Targeting European Companies and Organizations
  4. LDAP Enumeration: Unveiling the Double-Edged Sword of Active Directory
  5. Dirty DAG: New Vulnerabilities in Azure Data Factory’s Apache Airflow Integration
  6. Crypted Hearts: Exposing the HeartCrypt Packer-as-a-Service Operation
  7. Network Abuses Leveraging High-Profile Events: Suspicious Domain Registrations and Other Scams
  8. Threat Assessment: Howling Scorpius (Akira Ransomware)
  9. Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012 and CVE-2024-9474 (Updated Nov. 22)
  10. Lateral Movement on macOS: Unique and Popular Techniques and In-the-Wild Examples
  11. Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware
  12. FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications
  13. Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attack
  14. Global Companies Are Unknowingly Paying North Koreans: Here’s How to Catch Them
  15. ModeLeak: Privilege Escalation to LLM Model Exfiltration in Vertex AI
  16. Silent Skimmer Gets Loud (Again)
  17. Automatically Detecting DNS Hijacking in Passive DNS
  18. TA Phone Home: EDR Evasion Testing Reveals Extortion Actor's Toolkit
  19. Jumpy Pisces Engages in Play Ransomware
  20. Deceptive Delight: Jailbreak LLMs Through Camouflage and Distraction
  21. Gatekeeper Bypass: Uncovering Weaknesses in a macOS Security Mechanism
  22. Unit 42 Looks Toward the Threat Frontier: Preparing for Emerging AI Risks
  23. Lynx Ransomware: A Rebranding of INC Ransomware
  24. Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware
  25. No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection
  26. Detecting Vulnerability Scanning Traffic From Underground Tools Using Machine Learning
  27. Unraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpy
  28. Investigating Infrastructure and Tactics of Phishing-as-a-Service Platform Sniper Dz
  29. Inside SnipBot: The Latest RomCom Malware Variant
  30. Discovering Splinter: A First Look at a New Post-Exploitation Red Team Tool
  31. Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and macOS Backdoors
  32. Phishing Pages Delivered Through Refresh HTTP Response Header
  33. Threat Assessment: Repellent Scorpius, Distributors of Cicada3301 Ransomware
  34. Threat Assessment: North Korean Threat Groups
  35. Chinese APT Abuses VSCode to Target Government in Asia
  36. Spoofed GlobalProtect Used to Deliver Unique WikiLoader Variant
  37. TLD Tracker: Exploring Newly Released Top-Level Domains
  38. The Emerging Dynamics of Deepfake Scam Campaigns on the Web
  39. Bling Libra’s Tactical Evolution: The Threat Actor Group Behind ShinyHunters Ransomware
  40. Autoencoder Is All You Need: Profiling and Detecting Malicious DNS Traffic
  41. Leaked Environment Variables Allow Large-Scale Extortion Operation in Cloud Environments
  42. Unit 42 Attack Surface Threat Research: Over 23% of Internet-Connected Exposures Involve Critical IT and Security Infrastructure
  43. ArtiPACKED: Hacking Giants Through a Race Condition in GitHub Actions Artifacts
  44. Harnessing LLMs for Automating BOLA Detection
  45. Ransomware Review: First Half of 2024
  46. Fighting Ursa Luring Targets With Car for Sale
  47. Identifying a BOLA Vulnerability in Harbor, a Cloud-Native Container Registry
  48. Scam Attacks Taking Advantage of the Popularity of the Generative AI Wave
  49. AI Tool Identifies BOLA Vulnerabilities in Easy!Appointments
  50. Accelerating Analysis When It Matters
  51. Vulnerabilities in LangChain Gen AI
  52. From RA Group to RA World: Evolution of a Ransomware Group
  53. Container Breakouts: Escape Techniques in Cloud Environments
  54. Beware of BadPack: One Weird Trick Being Used Against Android Devices
  55. DarkGate: Dancing the Samba With Alluring Excel Files
  56. Dissecting GootLoader With Node.js
  57. Threat Brief: CVE-2024-6387 OpenSSH RegreSSHion Vulnerability
  58. The Contrastive Credibility Propagation Algorithm in Action: Improving ML-powered Data Loss Prevention
  59. Attackers Exploiting Public Cobalt Strike Profiles
  60. Attack Paths Into VMs in the Cloud
  61. Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia
  62. Payload Trends in Malicious OneNote Samples
  63. Leveraging DNS Tunneling for Tracking and Scanning
  64. Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 (Updated May 20)
  65. Muddled Libra’s Evolution to the Cloud
  66. It Was Not Me! Malware-Initiated Vulnerability Scanning Is on the Rise
  67. Threat Brief: Vulnerability in XZ Utils Data Compression Library Impacting Multiple Linux Distributions (CVE-2024-3094)
  68. Exposing a New BOLA Vulnerability in Grafana
  69. ASEAN Entities in the Spotlight: Chinese APT Group Targeting
  70. Large-Scale StrelaStealer Campaign in Early 2024
  71. Curious Serpens’ FalseFont Backdoor: Technical Analysis, Detection and Prevention
  72. Unit 42 Collaborative Research With Ukraine’s Cyber Agency To Uncover the Smoke Loader Backdoor
  73. Inside the Rabbit Hole: BunnyLoader 3.0 Unveiled
  74. Wireshark Tutorial: Exporting Objects From a Pcap
  75. The Art of Domain Deception: Bifrost's New Tactic to Deceive Users
  76. Navigating the Cloud: Exploring Lateral Movement Techniques
  77. Data From Chinese Security Services Company i-Soon Linked to Previous Chinese APT Campaigns
  78. Intruders in the Library: Exploring DLL Hijacking
  79. Threat Brief: ConnectWise ScreenConnect Vulnerabilities (CVE-2024-1708 and CVE-2024-1709)
  80. 2024 Unit 42 Incident Response Report: Navigating the Shift in Cybersecurity Threat Tactics
  81. Threat Brief: Attacks on Critical Infrastructure Attributed to Insidious Taurus (Volt Typhoon)
  82. New Vulnerability in QNAP QTS Firmware: CVE-2023-50358
  83. Diving Into Glupteba's UEFI Bootkit
  84. Ransomware Retrospective 2024: Unit 42 Leak Site Analysis
  85. Exploring the Latest Mispadu Stealer Variant
  86. ApateWeb: An Evasive Large-Scale Scareware and PUP Delivery Campaign
  87. Threat Assessment: BianLian
  88. Parrot TDS: A Persistent and Evolving Malware Campaign
  89. Threat Brief: Multiple Ivanti Vulnerabilities (Updated Feb. 29)
  90. Financial Fraud APK Campaign
  91. Medusa Ransomware Turning Your Files into Stone
  92. Tackling Anti-Analysis Techniques of GuLoader and RedLine Stealer
  93. Threat Vector Podcast

2023 93

  1. From DarkGate to AsyncRAT: Malware Detected and Shared As Unit 42 Timely Threat Intelligence
  2. Dual Privilege Escalation Chain: Exploiting Monitoring and Service Mesh Configurations and Privileges in GKE to Gain Unauthorized Access in Kubernetes
  3. Why Is an Australian Footballer Collecting My Passwords? The Various Ways Malicious JavaScript Can Steal Your Secrets
  4. Toward Ending the Domain Wars: Early Detection of Malicious Stockpiled Domains
  5. Fighting Ursa Aka APT28: Illuminating a Covert Campaign
  6. New Tool Set Found Used Against Organizations in the Middle East, Africa and the US
  7. Exploring a Critical Risk in Google Workspace's Domain-Wide Delegation Feature
  8. Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
  9. Stately Taurus Targets the Philippines As Tensions Flare in the South Pacific
  10. In-Depth Analysis of July 2023 Exploit Chain Featuring CVE-2023-36884 and CVE-2023-36584
  11. High Traffic + High Vulnerability = an Attractive Target for Criminals: The Dangers of Viewing Clickbait Sites
  12. Chinese APT Targeting Cambodian Government
  13. Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors
  14. Threat Brief: Citrix Bleed CVE-2023-4966
  15. Conducting Robust Learning for Empire Command and Control Detection
  16. Over the Kazuar’s Nest: Cracking Down on a Freshly Hatched Backdoor Used by Pensive Ursa (Aka Turla)
  17. CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys
  18. When PAM Goes Rogue: Malware Uses Authentication Modules for Mischief
  19. Threat Brief: Cisco IOS XE Web UI Privilege Escalation Vulnerability (Updated)
  20. BlackCat Climbs the Summit With a New Tactic
  21. Blocking Dedicated Attacking Hosts Is Not Enough: In-Depth Analysis of a Worldwide Linux XorDDoS Campaign
  22. Understanding DNS Tunneling Traffic in the Wild
  23. Wireshark Tutorial: Identifying Hosts and Users
  24. Leveraging a Hooking Framework to Expand Malware Detection Coverage on the Android Platform
  25. Threat Brief - MOVEit Transfer SQL Injection Vulnerabilities: CVE-2023-34362, CVE-2023-35036 and CVE-2023-35708 (Updated Oct 4)
  26. CL0P Seeds ^_- Gotta Catch Em All!
  27. Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government
  28. Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda
  29. Persistent Attempts at Cyberespionage Against Southeast Asian Government Target Have Links to Alloy Taurus
  30. Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government
  31. Fake CVE-2023-40477 Proof of Concept Leads to VenomRAT
  32. Threat Group Assessment: Turla (aka Pensive Ursa)
  33. Unit 42 Attack Surface Threat Research: Constant Change in Cloud Contributes to 45% of New High/Critical Exposures Per Month
  34. Wireshark Tutorial: Display Filter Expressions
  35. RedLine Stealer: Answers to Unit 42 Wireshark Quiz
  36. Wireshark Tutorial: Changing Your Column Display
  37. Why LaZagne Makes D-Bus API Vigilance Crucial
  38. Crossing the Line: Unit 42 Wireshark Quiz for RedLine Stealer
  39. When a Zero Day and Access Keys Collide in the Cloud: Responding to the SugarCRM Zero-Day Vulnerability
  40. NodeStealer 2.0 – The Python Version: Stealing Facebook Business Accounts
  41. Threat Brief: Multiple Vulnerabilities Including Zero-Day Remote Unauthenticated API Access – CVE-2023-35078 – in Ivanti Endpoint Manager Mobile (Updated)
  42. Threat Brief: RCE Vulnerability CVE-2023-3519 on Customer-Managed Citrix Servers
  43. Ransomware Delivery URLs: Top Campaigns and Trends
  44. Threat Group Assessment: Mallox Ransomware
  45. P2PInfect: The Rusty Peer-to-Peer Self-Replicating Worm
  46. CVE-2023-36884 - Microsoft Office and Windows HTML Remote Code Execution: Threat Brief (Updated)
  47. Diplomats Beware: Cloaked Ursa Phishing With a Twist
  48. Six Malicious Python Packages in the PyPI Targeting Windows Users
  49. Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor
  50. Detecting Popular Cobalt Strike Malleable C2 Profile Techniques
  51. IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
  52. Inside Win32k Exploitation: Analysis of CVE-2022-21882 and CVE-2021-1732
  53. Android Malware Impersonates ChatGPT-Themed Applications
  54. Inside Win32k Exploitation: Background on Implementations of Win32k and Exploitation Methodologies
  55. Analyzing Web Application and API Attacks: The Cloud as a Target and a Launch Pad
  56. Cold as Ice: Answers to Unit 42 Wireshark Quiz for IcedID
  57. Cold as Ice: Unit 42 Wireshark Quiz for IcedID
  58. Old Wine in the New Bottle: Mirai Variant Targets Multiple IoT Devices
  59. It’s All in the Name: How Unit 42 Defines and Tracks Threat Adversaries
  60. Threat Assessment: Royal Ransomware
  61. Teasing the Secrets From Threat Actors: Malware Configuration Parsing at Scale
  62. Network Security Trends: November 2022-January 2023
  63. Recent Trends in Internet Threats: Common Industries Impersonated in Phishing Attacks, Web Skimmer Analysis and More
  64. Chinese Alloy Taurus Updates PingPull Malware
  65. ChatGPT-Themed Scam Attacks Are on the Rise
  66. Threat Actors Rapidly Adopt Web3 IPFS Technology
  67. Unit 42 Unveils Most ‘Expansive’ Cloud Threat Research Yet: Cloud Threat Report Volume 7 Examines the Expanding Attack Surface
  68. Vice Society: A Tale of Victim Data Exfiltration via PowerShell, aka Stealing off the Land
  69. CryptoClippy Speaks Portuguese
  70. Threat Brief - CVE-2023-23397 - Microsoft Outlook Privilege Escalation
  71. Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated)
  72. Finding Gozi: Answers to Unit 42 Wireshark Quiz, March 2023
  73. Finding Gozi: Unit 42 Wireshark Quiz, March 2023
  74. Malicious JavaScript Injection Campaign Infects 51k Websites
  75. Unit 42 Ransomware and Extortion Report Highlights: Multi-Extortion Tactics Continue to Rise
  76. Tailoring Sandbox Techniques to Hidden Threats
  77. Bee-Ware of Trigona, An Emerging Ransomware Strain
  78. GoBruteforcer: Golang-Based Botnet Actively Harvests Web Servers
  79. Spike in LokiBot Activity During Final Week of 2022
  80. Subdomain Reputation: Detecting Malicious Subdomains of Public Apex Domains
  81. Answers to Unit 42 Wireshark Quiz, February 2023
  82. Unit 42 Wireshark Quiz, February 2023
  83. Mirai Variant V3G4 Targets IoT Devices
  84. Machine Learning Versus Memory Resident Evil
  85. Mitigating RBAC-Based Privilege Escalation in Popular Kubernetes Platforms
  86. Chinese PlugX Malware Hidden in Your USB Devices?
  87. Realtek SDK Vulnerability Attacks Highlight IoT Supply Chain Threats
  88. Answers to Unit 42 Wireshark Quiz, January 2023
  89. Unit 42 Wireshark Quiz, January 2023
  90. Chinese Playful Taurus Activity in Iran
  91. Network Security Trends: August-October 2022
  92. Security Issue in JWT Secret Poisoning (Updated)
  93. PurpleUrchin Bypasses CAPTCHA and Steals Cloud Platform Resources

2022 94

  1. Navigating the Vast Ocean of Sandbox Evasions
  2. Threat Brief: OWASSRF Vulnerability Exploitation
  3. Meddler-in-the-Middle Phishing Attacks Explained
  4. Russia’s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine
  5. Digging Inside Azure Functions: HyperV Is the Last Line of Defense
  6. Precious Gemstones: The New Generation of Kerberos Attacks
  7. Compromised Cloud Compute Credentials: Case Studies From the Wild
  8. Vice Society: Profiling a Persistent Threat to the Education Sector
  9. Blowing Cobalt Strike Out of the Water With Memory Analysis
  10. Threat Assessment: Luna Moth Callback Phishing Campaign
  11. An AI Based Solution to Detecting the DoubleZero .NET Wiper
  12. Network Security Trends: May-July 2022
  13. Typhon Reborn With New Capabilities
  14. Unit 42 Finds Three Vulnerabilities in OpenLiteSpeed Web Server
  15. Cobalt Strike Analysis and Tutorial: Identifying Beacon Team Servers in the Wild
  16. Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows
  17. Banking Trojan Techniques: How Financially Motivated Malware Became Infrastructure
  18. Defeating Guloader Anti-Analysis Technique
  19. Trends in Web Threats in CY Q2 2022: Malicious JavaScript Downloaders Are Evolving
  20. CNAME Cloaking: Disguising Third Parties Through the DNS
  21. Trends in Web Threats: Old Web Skimmer Still Active Today
  22. Detecting Emerging Network Threats From Newly Observed Domains
  23. Ransom Cartel Ransomware: A Possible Connection With REvil
  24. Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
  25. More Than Meets the Eye: Exposing a Polyglot File That Delivers IcedID
  26. Hunting for Unsigned DLLs to Find APTs
  27. Domain Shadowing: A Stealthy Use of DNS Compromise for Cybercrime
  28. Zero-Day Exploit Detection Using Machine Learning
  29. OriginLogger: A Look at Agent Tesla’s Successor
  30. Credential Gathering From Third-Party Software
  31. Mirai Variant MooBot Targeting D-Link Devices
  32. Tor 101: How Tor Works and its Risks to the Enterprise
  33. Threat Assessment: Black Basta Ransomware
  34. Legitimate SaaS Platforms Being Used to Host Phishing Attacks
  35. Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross-Site Scripting and More
  36. BlueSky Ransomware: Fast Encryption via Multithreading
  37. Novel News on Cuba Ransomware: Greetings From Tropical Scorpius
  38. Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware
  39. dotnetfile Open Source Python Library: Parsing .NET PE Files Has Never Been Easier
  40. Threat Brief: Microsoft Critical Vulnerabilities (CVE-2022-26809, CVE-2022-26923, CVE-2022-26925)
  41. Attackers Move Quickly to Exploit High-Profile Zero Days: Insights From the 2022 Unit 42 Incident Response Report
  42. IAM-Deescalate: An Open Source Tool to Help Users Reduce the Risk of Privilege Escalation
  43. Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
  44. Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive
  45. Unit 42 Threat Group Naming Update
  46. Digium Phones Under Attack: Insight Into the Web Shell Implant
  47. Cobalt Strike Analysis and Tutorial: CS Metadata Encryption and Decryption
  48. ChromeLoader: New Stubborn Malware Campaign
  49. When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors
  50. FabricScape: Escaping Service Fabric and Taking Over the Cluster
  51. There Is More Than One Way to Sleep: Dive Deep Into the Implementations of API Hammering by Various Malware Families
  52. Why Are My Junctions Not Followed? Exploring Windows Redirection Trust Mitigation
  53. GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool
  54. Exposing HelloXD Ransomware and x4k
  55. LockBit 2.0: How This RaaS Operates and How to Protect Against It
  56. Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022-26134) (Updated)
  57. Understanding REvil: REvil Threat Actors May Have Returned (Updated)
  58. Popping Eagle: How We Leveraged Global Analytics to Discover a Sophisticated Threat Actor
  59. Threat Brief: CVE-2022-30190 – MSDT Code Execution Vulnerability
  60. Network Security Trends: November 2021 to January 2022
  61. Operation Delilah: Unit 42 Helps INTERPOL Identify Nigerian Business Email Compromise Actor
  62. Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022-22954 and Others)
  63. Weaponization of Excel Add-Ins Part 2: Dridex Infection Chain Case Studies
  64. Emotet Summary: November 2021 Through January 2022
  65. A Look Into Public Clouds From the Ransomware Actor's Perspective
  66. Harmful Help: Analyzing a Malicious Compiled HTML Help File Delivering Agent Tesla
  67. Threat Brief: CVE-2022-1388
  68. Cobalt Strike Analysis and Tutorial: CS Metadata Encoding and Decoding
  69. Defeating BazarLoader Anti-Analysis Techniques
  70. Threat Assessment: BlackByte Ransomware
  71. AWS's Log4Shell Hot Patch Vulnerable to Container Escape and Privilege Escalation
  72. Gaining Visibility Within Container Clusters
  73. IAM Your Defense Against Cloud Threats: The Latest Unit 42 Cloud Threat Research
  74. Trends in Web Threats: Attackers Were More Active During Holiday Season
  75. New SolarMarker (Jupyter) Campaign Demonstrates the Malware’s Changing Attack Patterns
  76. CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild (SpringShell) (Updated)
  77. Threat Brief: Lapsus$ Group
  78. 2022 Unit 42 Ransomware Threat Report Highlights: Ransomware Remains a Headliner
  79. CVE-2021-28372: How a Vulnerability in Third-Party Technology Is Leaving Many IP Cameras and Surveillance Systems Vulnerable
  80. Cobalt Strike Analysis and Tutorial: How Malleable C2 Profiles Make Cobalt Strike Difficult to Detect
  81. Container Escape to Shadow Admin: GKE Autopilot Vulnerabilities
  82. New Linux Vulnerability CVE-2022-0492 Affecting Cgroups: Can Containers Escape?
  83. Know Your Infusion Pump Vulnerabilities and Secure Your Healthcare Organization
  84. Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot
  85. SockDetour – a Silent, Fileless, Socketless Backdoor – Targets U.S. Defense Contractors
  86. Russia-Ukraine Cyberattacks (Updated): How to Protect Against Related Cyberthreats Including DDoS, HermeticWiper, Gamaredon, Website Defacement, Phishing and Scams
  87. New Emotet Infection Method
  88. Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine
  89. Threat Assessment: BlackCat Ransomware
  90. Weaponization of Excel Add-Ins Part 1: Malicious XLL Files and Agent Tesla Case Studies
  91. Threat Brief: Ongoing Russia and Ukraine Cyber Activity
  92. Operation Falcon II: Unit 42 Helps INTERPOL Identify Nigerian Business Email Compromise Ring Members
  93. The Year in Web Threats: Web Skimmers Take Advantage of Cloud Hosting and More
  94. A New Web Skimmer Campaign Targets Real Estate Websites Through Attacking Cloud Video Distribution Supply Chain

2021 99

  1. Strategically Aged Domain Detection: Capture APT Attacks With DNS Traffic Trends
  2. Network Security Trends: August-October 2021
  3. Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021-44228) (Updated)
  4. Detecting Patient Zero Web Threats in Real Time With Advanced URL Filtering
  5. APT Expands Attack on ManageEngine With Active Campaign Against ServiceDesk Plus
  6. Play Your Cards Right: Detecting Wildcard DNS Abuse
  7. Observing Attacks Against Hundreds of Exposed Services in Public Clouds
  8. A Peek into Top-Level Domains and Cybercrime
  9. Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer
  10. Updated: New Evidence Emerges to Suggest WatchDog Was Behind Crypto Campaign
  11. Network Scanning Traffic Observed in Public Clouds
  12. Case Study: From BazarLoader to Network Reconnaissance
  13. Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
  14. SilverTerrier – Nigerian Business Email Compromise
  15. Wireshark Tutorial: Wireshark Workshop Videos Now Available
  16. Credential Harvesting at Scale Without Malware
  17. Highlights From the Unit 42 Cloud Threat Report, 2H 2021
  18. Network Security Trends: May-July 2021
  19. Threat Brief: OMI Vulnerabilities (CVE-2021-38645, CVE-2021-38647, CVE-2021-38648 and CVE-2021-38649)
  20. Dangling Domains: Security Threats, Detection and Prevalence
  21. Phishing Eager Travelers
  22. PhishingJS: A Deep Learning Model for JavaScript-Based Phishing Detection
  23. Finding Azurescape – Cross-Account Container Takeover in Azure Container Instances
  24. Threat Brief: CVE-2021-26084
  25. The Innocent Until Proven Guilty Learning Framework Helps Overcome Benign Append Attacks
  26. DNS Rebinding Attack: How Malicious Websites Exploit Private Networks
  27. New Mirai Variant Targets WebSVN Command Injection Vulnerability (CVE-2021-32305)
  28. Worldwide Phishing Attacks Ramped Up at the Peak of Working From Home
  29. Ransomware Groups to Watch: Emerging Threats
  30. Personal VPN and Its Evasions: Risk Factors and How to Maintain Network Visibility
  31. Discovering CAPTCHA Protected Phishing Campaigns
  32. New eCh0raix Ransomware Variant Targets QNAP and Synology Network-Attached Storage Devices
  33. Unit 42 Cloud Threat Report Update: Cloud Security Weakens as More Organizations Fail to Secure IAM
  34. Microsoft Patched the Issue With Windows Containers That Enabled Siloscape
  35. Palo Alto Networks Discloses New Attack Surface Targeting Microsoft IIS and SQL Server at Black Hat Asia 2021
  36. Ransomware Families: 2021 Data to Supplement the Unit 42 Ransomware Threat Report
  37. THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group
  38. Evade Sandboxes With a Single Bit – the Trap Flag
  39. Mespinoza Ransomware Gang Calls Victims “Partners,” Attacks with Gasket, "MagicSocks" Tools
  40. Threat Brief: Windows Print Spooler RCE Vulnerability (CVE-2021-34527 AKA PrintNightmare)
  41. Threat Brief: Kaseya VSA Ransomware Attack
  42. Network Attack Trends: February-April 2021
  43. Conti Ransomware Gang: An Overview
  44. Matanbuchus: Malware-as-a-Service with Demonic Intentions
  45. Prometheus Ransomware Gang: A Group of REvil?
  46. Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments
  47. TeamTNT Actively Enumerating Cloud Environments to Infiltrate Organizations
  48. Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat
  49. What Can You Learn From a “Wiped” Computer With Digital Forensics?
  50. Using AI to Detect Malicious C2 Traffic
  51. Breaking Down Ransomware Attacks
  52. BazarCall Method: Call Centers Help Spread BazarLoader Malware
  53. DarkSide Ransomware Gang: An Overview
  54. File Transfer Threats: Risk Factors and How Network Traffic Visibility Can Help
  55. Detecting and Preventing Malicious Domains Proactively with DNS Security
  56. New Shameless Commodity Cryptocurrency Stealer (WeSteal) and Commodity RAT (WeControl)
  57. Unsecured Kubernetes Instances Could Be Vulnerable to Exploitation
  58. Threat Brief: Codecov Bash Uploader
  59. Are Your Nagios XI Servers Turning Into Cryptocurrency Miners for Attackers?
  60. Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials
  61. New Vulnerability Affecting Container Engines CRI-O and Podman (CVE-2021-20291)
  62. Threat Assessment: Clop Ransomware
  63. Network Attack Trends: Internet of Threats (November 2020-January 2021)
  64. Emotet Command and Control Case Study
  65. Attackers Conducting Cryptojacking Operation Against U.S. Education Organizations
  66. Wireshark Tutorial: Examining Traffic from Hancitor Infections
  67. Highlights from the Unit 42 Cloud Threat Report, 1H 2021
  68. 2020 Phishing Trends With PDF Files
  69. Hancitor’s Use of Cobalt Strike and a Noisy Network Ping Tool
  70. Wireshark Tutorial: Decrypting RDP Traffic
  71. Threat Assessment: Matrix Ransomware
  72. 20 Million Miners: Finding Malicious Cryptojacking Images in Docker Hub
  73. Fake Websites Used in COVID-19 Themed Phishing Attacks, Impersonating Brands Like Pfizer and BioNTech
  74. Unit 42 Discovers 15 New Vulnerabilities Across Microsoft, Adobe and Apple Products
  75. Satori: Mirai Botnet Variant Targeting Vantage Velocity Field Unit RCE Vulnerability
  76. Ransomware Threat Assessments: A Companion to the 2021 Unit 42 Ransomware Threat Report
  77. Highlights from the 2021 Unit 42 Ransomware Threat Report
  78. New Mirai Variant Targeting Network Security Devices
  79. Threat Assessment: DearCry Ransomware
  80. Microsoft Exchange Server Attack Timeline
  81. Remediation Steps for the Microsoft Exchange Server Vulnerabilities
  82. Analyzing Attacks Against Microsoft Exchange Server With China Chopper Webshells
  83. Overview of dnsmasq Vulnerabilities: The Dangers of DNS Cache Poisoning
  84. Attack Chain Overview: Emotet in December 2020 and January 2021
  85. Threat Assessment: Active Exploitation of Four Zero-Day Vulnerabilities in Microsoft Exchange Server
  86. Threat Brief: Kerberos KDC Security Feature Bypass Vulnerability (CVE-2020-17049 AKA Bronze Bit)
  87. Fast Flux 101: How Cybercriminals Improve the Resilience of Their Infrastructure to Evade Detection and Law Enforcement Takedowns
  88. IronNetInjector: Turla’s New Malware Loading Tool
  89. WatchDog: Exposing a Cryptojacking Campaign That’s Operated for Two Years
  90. Threat Brief: Windows IPv4 and IPv6 Stack Vulnerabilities (CVE-2021-24074, CVE-2021-24086 and CVE-2021-24094)
  91. BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech
  92. Exploits in the Wild for WordPress File Manager RCE Vulnerability (CVE-2020-25213)
  93. Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes
  94. Pro-Ocean: Rocke Group’s New Cryptojacking Malware
  95. Network Attack Trends: Internet of Threats (August-October 2020)
  96. Wireshark Tutorial: Examining Emotet Infection Traffic
  97. Open Source Tool Release: Gaining Novel AWS Access With EBS Direct APIs
  98. xHunt Campaign: New BumbleBee Webshell and SSH Tunnels Used for Lateral Movement
  99. TA551: Email Attack Campaign Switches from Valak to IcedID

2020 93

  1. The History of DNS Vulnerabilities and the Cloud
  2. SolarStorm Supply Chain Attack Timeline
  3. Protecting Against an Unfixed Kubernetes Man-in-the-Middle Vulnerability (CVE-2020-8554)
  4. SUPERNOVA: A Novel .NET Webshell
  5. Threat Brief: SolarStorm and SUNBURST Customer Coverage
  6. PyMICROPSIA: New Information-Stealing Trojan from AridViper
  7. Threat Brief: FireEye Red Team Tool Breach
  8. PGMiner: New Cryptocurrency Mining Botnet Delivered via PostgreSQL
  9. Threat Brief: VMware Command Injection Vulnerability (CVE-2020-4006)
  10. njRAT Spreading Through Active Pastebin Command and Control Tunnel
  11. Threat Assessment: Egregor Ransomware
  12. Exploitation of Windows RDP Vulnerability CVE-2019-0708 (BlueKeep): Get RCE with System Privilege Using Refresh Rect PDU and RDPDR Client Name Request PDU
  13. Android Apps Leaking Sensitive Data Found on Google Play With 6 Million U.S. Downloads
  14. IAMFinder: Open Source Tool to Identify Information Leaked from AWS IAM Reconnaissance
  15. Information Leakage in AWS Resource-Based Policy APIs
  16. A Closer Look at the Web Skimmer
  17. xHunt Campaign: Newly Discovered Backdoors Using Deleted Email Drafts and DNS Tunneling for Command and Control
  18. When Threat Actors Fly Under the Radar: Vatet, PyXie and Defray777
  19. Windows XP, Server 2003 Source Code Leak Leaves IoT, OT Devices Vulnerable
  20. Threat Assessment: Ryuk Ransomware
  21. Domain Parking: A Gateway to Attackers Spreading Emotet and Impersonating McAfee
  22. Risks in IoT Supply Chain
  23. Wireshark Tutorial: Examining Dridex Infection Traffic
  24. Threat Brief: Microsoft Vulnerability CVE-2020-16898
  25. Two New IoT Vulnerabilities Identified with Mirai Payloads
  26. CVE-2020-14386: Privilege Escalation Vulnerability in the Linux kernel
  27. Unit 42 Cloud Threat Report: Misconfigured IAM Roles Lead to Thousands of Compromised Cloud Workloads
  28. Unit 42 Cloud Threat Report: CSP Findings on Logging, Encryption and Exposed Services
  29. Highlights from the Unit 42 Cloud Threat Report, 2H 2020
  30. Black-T: New Cryptojacking Variant from TeamTNT
  31. Unit 42 Discovers 27 New Vulnerabilities Across Microsoft Products
  32. Top Alexa Sites Infected With Malicious Coinminers and Web Skimmer
  33. Case Study: Emotet Thread Hijacking, an Email Attack Technique
  34. Introducing Actionable Threat Objects and Mitigations (ATOMs)
  35. Threat Brief: Microsoft Vulnerability CVE-2020-1472 “Zerologon”
  36. Network Attack Trends: Attackers Leveraging High Severity and Critical Exploits (May-July 2020)
  37. The Challenge of Persistence in Containers and Serverless
  38. Thanos Ransomware: Destructive Variant Targeting State-Run Organizations in the Middle East and North Africa
  39. Exploits in the Wild for vBulletin Pre-Auth RCE Vulnerability CVE-2020-17496
  40. Cybersquatting: Attackers Mimicking Domains of Major Brands Including Facebook, Apple, Amazon and Netflix to Scam Consumers
  41. Cetus: Cryptojacking Worm Targeting Docker Daemons
  42. The State of Exploit Development: 80% of Exploits Publish Faster than CVEs
  43. Wireshark Tutorial: Decrypting HTTPS Traffic
  44. Script-Based Malware: A New Attacker Trend on Internet Explorer
  45. Threat Assessment: WastedLocker Ransomware
  46. Kubernetes Vulnerability Puts Clusters at Risk of Takeover (CVE-2020-8558)
  47. Evolution of Valak, from Its Beginnings to Mass Distribution
  48. OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory
  49. Threat Brief: Microsoft DNS Server Wormable Vulnerability CVE-2020-1350
  50. 3 Vulnerabilities Found on AvertX IP Cameras
  51. Windows Server Containers Are Open, and Here's How You Can Break Out
  52. Threat Assessment: EKANS Ransomware
  53. Attackers Cryptojacking Docker Images to Mine for Monero
  54. Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices
  55. An Overview of GPS Tracking and Future Application for IoT
  56. AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations
  57. 6 New Vulnerabilities Found on D-Link Home Routers
  58. Threat Assessment: Hangover Threat Group
  59. Goodbye Mworm, Hello Nworm: TrickBot Updates Propagation Module
  60. Rootless Containers: The Next Trend in Container Security
  61. Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self-Hiding
  62. Mirai and Hoaxcalls Botnets Target Legacy Symantec Web Gateways
  63. Updated BackConfig Malware Targeting Government and Military Organizations in South Asia
  64. COVID-19 Themed Malware Within Cloud Environments
  65. Threat Brief: Maze Ransomware
  66. SilverTerrier: New COVID-19 Themed Business Email Compromise Schemes
  67. COVID-19: Cloud Threat Landscape
  68. Anatomy of Formjacking Attacks
  69. Studying How Cybercriminals Prey on the COVID-19 Pandemic
  70. Malicious Attackers Target Government and Medical Organizations With COVID-19 Themed Phishing Campaigns
  71. APT41 Using New Speculoos Backdoor to Target Organizations Globally
  72. Grandstream and DrayTek Devices Exploited to Power New Hoaxcalls DDoS Botnet
  73. GuLoader: Malspam Campaign Installing NetWire RAT
  74. SilverTerrier: 2019 Nigerian Business Email Compromise Update
  75. Don’t Panic: COVID-19 Cyber Threats
  76. New Mirai Variant Targets Zyxel Network-Attached Storage Devices
  77. Threat Brief: Microsoft SMBv3 Wormable Vulnerability CVE-2020-0796
  78. 2020 Unit 42 IoT Threat Report
  79. Molerats Delivers Spark Backdoor to Government and Telecommunications Organizations
  80. Cortex XDR™ Detects New Phishing Campaign Installing NetSupport Manager RAT
  81. Can You Trust Your AutoIT Decompiler?
  82. Wireshark Tutorial: Examining Qakbot Infections
  83. Unit 42 CTR: Leaked Code from Docker Registries
  84. Unit 42 CTR: Sensitive Data Exposed in GitHub
  85. Unit 42 Cloud Threat Report: Spring 2020
  86. Actors Still Exploiting SharePoint Vulnerability to Attack Middle East Government Organizations
  87. Attacker’s Tactics and Techniques in Unsecured Docker Daemons Revealed
  88. xHunt Campaign: New Watering Hole Identified for Credential Harvesting
  89. The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks
  90. Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices
  91. Threat Brief: Windows CryptoAPI Spoofing Vulnerability CVE-2020-0601
  92. Exploits in the Wild for Citrix ADC and Citrix Gateway Directory Traversal Vulnerability CVE-2019-19781
  93. Threat Brief: Iranian-Linked Cyber Operations

2019 84

  1. Wireshark Tutorial: Examining Ursnif Infections
  2. Unit 42 Discovers 13 New Vulnerabilities Across Microsoft and Adobe Products
  3. Rancor: Cyber Espionage Group Uses New Custom Malware to Attack Southeast Asia
  4. Mirai Variant ECHOBOT Resurfaces with 13 Previously Unexploited Vulnerabilities
  5. Unit 42 Presents New Research at BlueHat Seattle on Three New Windows RDP Vulnerability Exploit Methods
  6. What I Learned from Reverse Engineering Windows Containers
  7. TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks
  8. xHunt Campaign: xHunt Actor’s Cheat Sheet
  9. APAC’s Compromised Domains Fuel Emotet Campaign
  10. Imminent Monitor – a RAT Down Under
  11. Server-Side Request Forgery Exposes Data of Technology, Industrial and Media Organizations
  12. Trickbot Updates Password Grabber Module
  13. Docker Patched the Most Severe Copy Vulnerability to Date With CVE-2019-14271
  14. Wireshark Tutorial: Examining Trickbot Infections
  15. Web-Based Threats: First Half 2019
  16. Home & Small Office Wireless Routers Exploited to Attack Gaming Servers
  17. Practical Behavioral Profiling of PowerShell Scripts through Static Analysis (Part 3)
  18. Practical Behavioral Profiling of PowerShell Scripts through Static Analysis (Part 2)
  19. Practical Behavioral Profiling of PowerShell Scripts through Static Analysis (Part 1)
  20. Graboid: First-Ever Cryptojacking Worm Found in Images on Docker Hub
  21. Blackremote: Money Money Money – A Swedish Actor Peddles an Expensive New RAT
  22. xHunt Campaign: New PowerShell Backdoor Blocked Through DNS Tunnel Detection
  23. Exploits in the Wild for vBulletin Pre-Auth RCE Vulnerability CVE-2019-16759
  24. PKPLUG: Chinese Cyber Espionage Group Attacking Southeast Asia
  25. xHunt Campaign: Attacks on Kuwait Shipping and Transportation Organizations
  26. Critical Vulnerability in Harbor Enables Privilege Escalation from Zero to Admin (CVE-2019-16097)
  27. The Legend of Adwind: A Commodity RAT Saga in Eight Parts
  28. Unit 42 Named Top Zero-Day Vulnerability Contributor by Microsoft
  29. Gaining Persistency on Vulnerable Lambdas
  30. Exploitation of Windows CVE-2019-0708 (BlueKeep): Three Ways to Write Data into Kernel with RDP PDU
  31. Non-Root Containers, Kubernetes CVE-2019-11245 and Why You Should Care
  32. Newly Registered Domains: Malicious Abuse by Bad Actors
  33. Hunting the Public Cloud for Exposed Hosts and Misconfigurations
  34. Rocke'in the NetFlow
  35. Unveiling 11 New Adversary Playbooks
  36. MyDoom Still Active in 2019
  37. Cloudy with a Chance of Entropy
  38. USBCreator D-Bus Privilege Escalation in Ubuntu Desktop
  39. Tale of a Windows Error Reporting Zero-Day (CVE-2019-0863)
  40. The Gopher in the Room: Analysis of GoLang Malware in the Wild
  41. Evasion of Security Policies by VPN Clients Poses Great Risk to Network Operators
  42. TCP SACK Panics Linux Servers
  43. Unit 42 Discovers 10 New Microsoft Vulnerabilities
  44. Hide ‘N Seek Botnet Updates Arsenal with Exploits Against Nexus Repository Manager & ThinkPHP
  45. New Mirai Variant Adds 8 New Exploits, Targets Additional IoT Devices
  46. Misconfigured and Exposed: Container Services
  47. Making Containers More Isolated: An Overview of Sandboxed Container Technologies
  48. Unit 42 Discovers Vulnerabilities in Adobe Acrobat and Reader and Foxit Reader, Shares Threat Research at Microsoft BlueHat Shanghai 2019
  49. Web-based Threats-2018 Q4: France Rises to #1 for Malicious URL Hosting, US #1 for Phishing
  50. Breaking Out of rkt – 3 New Unpatched CVEs
  51. Emissary Panda Attacks Middle East Government SharePoint Servers
  52. Shade Ransomware Hits High-Tech, Wholesale, Education Sectors in U.S, Japan, India, Thailand, Canada
  53. SilverTerrier: 2018 Nigerian Business Email Compromise Update
  54. Attackers Increasingly Targeting Oracle WebLogic Server Vulnerability for XMRig and Ransomware
  55. Muhstik Botnet Exploits the Latest WebLogic Vulnerability for Cryptomining and DDoS Attacks
  56. Behind the Scenes with OilRig
  57. BabyShark Malware Part Two – Attacks Continue Using KimJongRAT and PCRat
  58. Don't Panic Podcast - Watering Hole Attacks
  59. Takedowns and Adventures in Deceptive Affiliate Marketing
  60. Exploits in the Wild for WordPress Social Warfare Plugin CVE-2019-9978
  61. Aggah Campaign: Bit.ly, BlogSpot, and Pastebin Used for C2 in Large Scale Campaign
  62. DNS Tunneling in the Wild: Overview of OilRig’s DNS Tunneling
  63. Mirai Compiled for New Processors Surfaces in the Wild
  64. Disclosing a directory traversal vulnerability in Kubernetes copy – CVE-2019-1002101
  65. Born This Way? Origins of LockerGoga
  66. Cardinal RAT Sins Again, Targets Israeli Fin-Tech Firms
  67. New Mirai Variant Targets Enterprise Wireless Presentation & Display Systems
  68. DNS Tunneling: how DNS can be (ab)used by malicious actors
  69. Operation Comando: How to Run a Cheap and Effective Credit Card Business
  70. New Python-Based Payload MechaFlounder Used by Chafer
  71. Farseer: Previously Unknown Malware Family bolsters the Chinese armoury
  72. Multiple ArtraDownloader Variants Used by BITTER to Target Pakistan
  73. Unit 42 Vulnerability Research Team Discovers 23 New Vulnerabilities February 2019 Disclosures – Adobe and Microsoft
  74. New BabyShark Malware Targets U.S. National Security Think Tanks
  75. Breaking out of Docker via runC – Explaining CVE-2019-5736
  76. Shifting in the Wind: WINDSHIFT Attacks Target Middle Eastern Governments
  77. Threat Brief: Understanding Domain Generation Algorithms (DGA)
  78. menuPass Playbook and IOCs
  79. Tracking OceanLotus’ new Downloader, KerrDown
  80. Mac Malware Steals Cryptocurrency Exchanges’ Cookies
  81. Russian Language Malspam Pushing Redaman Banking Malware
  82. DarkHydrus delivers new Trojan that can use Google Drive for C2 communications
  83. Malware Used by Rocke Group Evolves to Evade Detection by Cloud Security Products
  84. Caught in the Act: From Intrusive Coin Miners to Scam Websites

2018 93

  1. Web-based Threats-2018 Q3: Malicious URLs and Domains take a Dip
  2. Analysis of Smoke Loader in New Tsunami Campaign
  3. Shamoon 3: Modified Open-Source Wiper Contains Verse from the Quran
  4. Threat Intelligence Has Never Looked Better – Announcing the Unit 42 Research Portal
  5. Sofacy Creates New ‘Go’ Variant of Zebrocy Tool
  6. Shamoon 3 Targets Oil and Gas Organization
  7. Threat Brief: Twelve Tips for the Holidays
  8. Cyberthreats in 2019: The Trends That Will Continue to Move Upward
  9. Dear Joohn: The Sofacy Group’s Global Campaign
  10. Unit 42 Cloud Security Trends and Tips
  11. Demystifying Kubernetes CVE-2018-1002105 (and a dead simple exploit)
  12. Don’t Panic Podcast Returns with Season 3
  13. The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia
  14. New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit
  15. Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan
  16. Analyzing OilRig's Ops Tempo from Testing to Weaponization to Delivery
  17. Inception Attackers Target Europe with Year-old Office Vulnerability
  18. New Techniques to Uncover and Attribute Cobalt Gang Commodity Builders and Infrastructure Revealed
  19. Threat Brief: Embrace Mobile Banking with Caution
  20. Detecting Malicious Campaigns with Machine Learning
  21. Fake Flash Updaters Push Cryptocurrency Miners
  22. Unit 42 Vulnerability Research October 2018 Disclosures – Adobe
  23. NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT
  24. New KONNI Malware attacking Eurasia and Southeast Asia
  25. Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows
  26. OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government
  27. Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, SonicWall
  28. Traps Prevents In-The-Wild VBScript Zero-Day Exploit in Internet Explorer
  29. Slicing and Dicing CVE-2018-5002 Payloads: New CHAINSHOT Malware
  30. Web-based Threats-2018 Q2: U.S. Remains #1 in Malicious Web Addresses, China Falls from #2 to #7
  31. OilRig targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE
  32. Threat Brief: Information on Critical Apache Struts Vulnerability CVE-2018-11776
  33. Four Unit 42 Vulnerability Researchers Make MSRC Top 100 for 2018
  34. Threat Brief: Cyber Attackers Using Your Home Router To Bring Down Websites
  35. DarkHydrus Uses Phishery to Harvest Credentials in the Middle East
  36. The Gorgon Group: Slithering Between Nation State and Cybercrime
  37. Bisonal Malware Used in Attacks Against Russia and South Korea
  38. Hidden Devil in the Development Life Cycle: Google Play Apps Infected with Windows Executable Files
  39. New Threat Actor Group DarkHydrus Targets Middle East Government
  40. Decrypting the LockCrypt Ransomware
  41. OilRig Targets Technology Service Provider and Government Agency with QUADAGENT
  42. Threat Brief: Office Documents Can Be Dangerous (But We’ll Continue to Use Them Anyway)
  43. Unit 42 Finds New Mirai and Gafgyt IoT/Linux Botnet Campaigns
  44. Malware Team Up: Malspam Pushing Emotet + Trickbot
  45. Analysis of the DHCP Client Script Code Execution Vulnerability (CVE-2018-1111)
  46. Upatre Continued to Evolve with new Anti-Analysis Techniques
  47. Threat Brief: Why You Need to Be Careful of Links in Email
  48. Unit 42 Vulnerability Research July 2018 Disclosures – Adobe
  49. RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families
  50. Tick Group Weaponized Secure USB Drives to Target Air-Gapped Critical Systems
  51. Don’t Panic About Software Supply Chain Attacks
  52. The Old and New: Current Trends in Web-based Threats
  53. Phishing in a Nutshell: January – March 2018
  54. The Rise of the Cryptocurrency Miners
  55. Sofacy Group’s Parallel Attacks
  56. Unit 42 Vulnerability Research May 2018 Disclosures – Adobe
  57. SilverTerrier Update: Increasingly Sophisticated Nigerian Cybercriminals Take Bigger Part of $3B BEC-Related Losses
  58. Exploit in the Wild: #drupalgeddon2 - Analysis of CVE-2018-7600
  59. HenBox: Inside the Coop
  60. SquirtDanger: The Swiss Army Knife Malware from Veteran Malware Author TheBottle
  61. Say “Cheese”: WebMonitor RAT Comes with C2-as-a-Service (C2aaS)
  62. Reaper Group’s Updated Mobile Arsenal
  63. Smoking Out the Rarog Cryptocurrency Mining Trojan
  64. TeleRAT: Another Android Trojan Leveraging Telegram’s Bot API to Target Iranian Users
  65. Sofacy Uses DealersChoice to Target European Government Agency
  66. HenBox: The Chickens Come Home to Roost
  67. Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent
  68. Threat Brief: What’s Driving the Shift to Cryptocurrency Mining Malware?
  69. Sure, I’ll take that! New ComboJack Malware Alters Clipboards to Steal Cryptocurrency
  70. Monero Miners Continue to Plague Users via Russian BitTorrent Site
  71. Threat Brief: Sofacy Group Targeting European and North American Diplomats
  72. Sofacy Attacks Multiple Government Entities
  73. Dissecting Hancitor’s Latest 2018 Packer
  74. Rig EK One Year Later: From Ransomware to Coin Miners and Information Stealers
  75. Threat Brief: A Declining Rig Exploit Kit Hops on the Coinmining Bandwagon
  76. OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan
  77. It’s Back! Don’t Panic, the Unit 42 Podcast, Returns with New Episodes
  78. Unit 42 Vulnerability Research February 2018 Disclosures - Adobe
  79. Traps Prevents Adobe Flash Player Zero-Day
  80. Threat Brief: Hancitor Actors
  81. Compromised Servers & Fraud Accounts: Recent Hancitor Attacks
  82. RAT Trapped? LuminosityLink Falls Foul of Vermin Eradication Efforts
  83. Comnie Continues to Target Organizations in East Asia
  84. VERMIN: Quasar RAT and Custom Malware Used In Ukraine
  85. The TopHat Campaign: Attacks Within The Middle East Region Using Popular Third-Party Services
  86. OilRig uses RGDoor IIS Backdoor on Targets in the Middle East
  87. Threat Brief: Malware Authors Mine Monero Across the Globe in a Big Way
  88. Large Scale Monero Cryptocurrency Mining Operation using XMRig
  89. Traps Prevents Microsoft Office Equation Editor Zero-Day CVE-2018-0802
  90. PowerStager Analysis
  91. IoT Malware Evolves to Harvest Bots by Exploiting a Zero-day Home Router Vulnerability
  92. Unit 42 Vulnerability Research January 2018 Disclosures - Microsoft
  93. Threat Brief: Meltdown and Spectre Vulnerabilities

2017 111

  1. Palo Alto Networks Unit 42 Vulnerability Research December 2017 Disclosures - Microsoft
  2. Abusing the Service Control Manager to Establish Persistence for Non-Service Applications
  3. Introducing the Adversary Playbook: First up, OilRig
  4. OilRig Performs Tests on the TwoFace Webshell
  5. Analysis of CVE-2017-11882 Exploit in the Wild
  6. Master Channel: The Boleto Mestre Campaign Targets Brazil
  7. Palo Alto Networks Unit 42 Vulnerability Research November 2017 Disclosures - Adobe
  8. Threat Brief: Unauthorized Coin Mining – A New Threat Facing Shoppers and Retailers This Holiday Season
  9. UBoatRAT Navigates East Asia
  10. Palo Alto Networks Unit 42 Vulnerability Research November 2017 Disclosures
  11. Using Existing Malware to Save You Time
  12. 2 Minute Threat Brief: Expanding Targets for New SunOrcal Malware Variant
  13. Operation Blockbuster Goes Mobile
  14. SunOrcal Adds GitHub and Steganography to its Repertoire, Expands to Vietnam and Myanmar
  15. Muddying the Water: Targeted Attacks in the Middle East
  16. Threat Brief: Why Ransomware Hurts So Much and Is So Hard to Stop
  17. New Malware with Ties to SunOrcal Discovered
  18. OilRig Deploys “ALMA Communicator” – DNS Tunneling Trojan
  19. Recent InPage Exploits Lead to Multiple Malware Families
  20. Everybody Gets One: QtBot Used to Distribute Trickbot and Locky
  21. Tracking Subaat: Targeted Phishing Attack Leads to Threat Actor's Repository
  22. Threat Brief: Information on Bad Rabbit Ransomware Attacks
  23. 2 Minute Threat Brief: Browser Cryptocurrency Mining
  24. BadPatch
  25. Threat Brief: Drive-by Mining - Adapting an Old Attack to Mine Cryptocurrencies
  26. Unauthorized Coin Mining in the Browser
  27. Palo Alto Networks Unit 42 Vulnerability Research September and October 2017 Disclosures
  28. OilRig Group Steps Up Attacks with New Delivery Documents and New Injector Trojan
  29. Threat Brief: Understanding Kernel APC Attacks
  30. 2 Minute Threat Brief: FreeMilk Conversation Hijacking Spear Phishing Campaign
  31. Threat Brief: Conversation Hijacking Spear Phishing
  32. FreeMilk: A Highly Targeted Spear Phishing Campaign
  33. Threat Actors Target Government of Belarus Using CMSTAR Trojan
  34. Striking Oil: A Closer Look at Adversary Infrastructure
  35. Analyzing the Various Layers of AgentTesla’s Packing
  36. 2 Minute Threat Brief: Android Toast Overlay Attack
  37. Palo Alto Networks Discovers New QEMU Vulnerability
  38. LabyREnth CTF 2017: Check Out the Prizes
  39. Threat Brief: Patch Today and Don’t Get Burned by an Android Toast Overlay
  40. Android Toast Overlay Attack: “Cloak and Dagger” with No Permissions
  41. Analysing a 10-Year-Old SNOWBALL
  42. EITest: HoeflerText Popups Targeting Google Chrome Users Now Push RAT Malware
  43. Updated KHRAT Malware Used in Cambodia Attacks
  44. Palo Alto Networks Unit 42 Vulnerability Research August 2017 Disclosures
  45. The Curious Case of Notepad and Chthonic: Exposing a Malicious Infrastructure
  46. The Blockbuster Saga Continues
  47. Microsoft Honors 5 Unit 42 Researchers for Vulnerability Research
  48. LabyREnth CTF 2017 Winners!
  49. Prince of Persia – Ride the Lightning: Infy returns as “Foudre”
  50. TwoFace Webshell: Persistent Access Point for Lateral Movement
  51. OilRig Uses ISMDoor Variant; Possibly Linked to Greenbug Threat Group
  52. “Tick” Group Continues Attacks
  53. Malspam Targeting Brazil Continues to Evolve
  54. LabyREnth CTF 2017 Final Week: Beat the Maze!
  55. EMEA Bi-Monthly Threat Reports: Turkey, Saudi Arabia & United Arab Emirates
  56. SpyDealer: Android Trojan Spying on More Than 40 Apps
  57. VIDEO: Tips, Tricks, and Clues to Escape the LabyREnth CTF
  58. Threat Brief: Petya Ransomware
  59. Paranoid PlugX
  60. The New and Improved macOS Backdoor from OceanLotus
  61. Decline in Rig Exploit Kit
  62. LabyREnth CTF 2017 Launch Day: The Challenge Starts Now!
  63. EMEA Bi-Monthly Threat Reports: United Kingdom, Germany & France
  64. LabyREnth CTF 2017: One Week Countdown
  65. Palo Alto Networks Unit 42 Vulnerability Research May 2017 Disclosures
  66. A Dissection of the “EsteemAudit” Windows Remote Desktop Exploit
  67. Threat Brief: WanaCrypt0r– What We Know
  68. LabyREnth Teaser Site
  69. Practice Makes Perfect: Nemucod Evolves Delivery and Obfuscation Techniques to Harvest Credentials
  70. Kazuar: Multiplatform Espionage Backdoor with API Access
  71. OilRig Actors Provide a Glimpse into Development and Testing Efforts
  72. Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
  73. Review of Regional Malware Trends in EMEA: Part 2
  74. Cardinal RAT Active for Over Two Years
  75. LabyREnth CTF 2017: We’re At It Again…
  76. Pulling the Brake on the Magnitude EK Train
  77. Ewind – Adware in Applications’ Clothing
  78. The Blockbuster Sequel
  79. New IoT/Linux Malware Targets DVRs, Forms Botnet
  80. Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA
  81. Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations
  82. Dimnie: Hiding in Plain Sight
  83. Threat Brief: Credential Theft - The Keystone of the Shamoon 2 Attacks
  84. Shamoon 2: Delivering Disttrack
  85. A New Trend in Android Adware: Abusing Android Plugin Frameworks
  86. New White Paper on Preventing Credential Phishing, Theft and Abuse
  87. Palo Alto Networks Unit 42 Vulnerability Research March 2017 Disclosures
  88. NexusLogger: A New Cloud-based Keylogger Enters the Market
  89. Regional Malware Trends in Latin America: July - December 2016
  90. Pulling Back the Curtains on EncodedCommand PowerShell Attacks
  91. Targeted Ransomware Attacks Middle Eastern Government Organizations for Political Purposes
  92. Palo Alto Networks Unit 42 Vulnerability Research February 2017 Disclosures
  93. "Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware
  94. Google Play Apps Infected with Malicious IFrames
  95. The Gamaredon Group Toolset Evolution
  96. menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations
  97. Banking Trojans: Ursnif Global Distribution Networks Identified
  98. Magic Hound Campaign Attacks Saudi Targets
  99. XAgentOSX: Sofacy’s XAgent macOS Tool
  100. Unique Office Loader Deploying Multiple Malware Families
  101. StegBaus: Because Sometimes XOR Just Isn’t Enough
  102. Exploring the Cybercrime Underground: Part 4 - Darknet Markets
  103. Threat Brief: Shamoon 2 Wave 3 Attacks
  104. Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments
  105. Farming Malicious Documents to Unravel Ransomware
  106. Exploring the Cybercrime Underground: Part 3 – Into the RAT Nest
  107. Threat Brief: Second Wave of Shamoon 2 Attacks Reveal Possible New Tactic
  108. Campaign Evolution: EITest from October through December 2016
  109. Second Wave of Shamoon 2 Attacks Identified
  110. 2016 Updates to Shifu Banking Trojan
  111. DragonOK Updates Toolset and Targets Multiple Geographic Regions

2016 100

  1. Campaign Evolution: pseudo-Darkleech in 2016
  2. Review of Regional Malware Trends in EMEA: Part 1
  3. Palo Alto Networks Unit 42 Vulnerability Research December 2016 Disclosures
  4. Let It Ride: The Sofacy Group’s DealersChoice Attacks Continue
  5. SamSa Ransomware Attacks: A Year in Review
  6. PluginPhantom: New Android Trojan Abuses “DroidPlugin” Framework
  7. Shamoon 2: Return of the Disttrack Wiper
  8. Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy
  9. Exploit Kits Exposed: Automated Attacks at Scale
  10. That Nigerian Prince Has Evolved His Game
  11. PSA: Conference Invite used as a Lure by Operation Lotus Blossom Actors
  12. Houdini’s Magic Reappearance
  13. Palo Alto Networks Researcher Discovers Four Critical Vulnerabilities in Adobe Flash Player
  14. Can I spam from here: An Unusually Clever Spambot Tests Blacklists
  15. ‘DealersChoice’ is Sofacy’s Flash Player Exploit Platform
  16. Palo Alto Networks Discovers Two Adobe Reader Privileged JavaScript Zero-Days
  17. OilRig Malware Campaign Updates Toolset and Expands Targets
  18. EITest Campaign Evolution: From Angler EK to Neutrino and Rig
  19. Confucius Says...Malware Families Get Further By Abusing Legitimate Websites
  20. Sofacy’s ‘Komplex’ OS X Trojan
  21. Palo Alto Networks Researcher Discovers Eight Critical Vulnerabilities in Adobe Flash Player
  22. MILE TEA: Cyber Espionage Campaign Targets Asia Pacific Businesses and Government Agencies
  23. DualToy: New Windows Trojan Sideloads Risky Apps to Android and iOS Devices
  24. The Dukes R&D Finds a New Anti-Analysis Technique
  25. Pythons and Unicorns and Hancitor…Oh My! Decoding Binaries Through Emulation
  26. Exploring the Cybercrime Underground: Part 2 – The Forum Ecosystem
  27. LabyREnth Capture the Flag (CTF): Unix Track Solutions
  28. VB Dropper and Shellcode for Hancitor Reveal New Techniques Behind Uptick
  29. Exploring the Cybercrime Underground: Part 1 – An Introduction
  30. Aveo Malware Family Targets Japanese Speaking Users
  31. Unit 42 Researchers Recognized in MSRC Top 100 List
  32. Fresh Baked HOMEKit-made Cookles – With a DarkHotel Overlap
  33. Orcus – Birth of an unusual plugin builder RAT
  34. Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
  35. SpyNote Android Trojan Builder Leaked
  36. Palo Alto Networks Researchers Discover Critical Safari 9.1 Vulnerability
  37. Attack Delivers ‘9002’ Trojan Through Google Drive
  38. PowerWare Ransomware Spoofing Locky Malware Family
  39. Technical Walkthrough: Office Test Persistence Method Used In Recent Sofacy Attacks
  40. Andromeda Botnet Targets Italy in Recent Spam Campaigns
  41. Palo Alto Networks Researchers Discover Two Critical Internet Explorer Vulnerabilities
  42. How to Track Actors Behind Keyloggers Using Embedded Credentials
  43. Investigating the LuminosityLink Remote Access Trojan Configuration
  44. CryptoBit: Another Ransomware Family Gets an Update
  45. A Quick Update On Our LabyREnth CTF Challenge
  46. Recent MNKit Exploit Activity Reveals Some Common Threads
  47. Prince of Persia – Game Over
  48. Tracking Elirks Variants in Japan: Similarities to Previous Attacks
  49. Extending AutoFocus Threat Intelligence With New Tag Types
  50. New Sofacy Attacks Against US Government Agency
  51. Using IDAPython to Make Your Life Easier: Part 6
  52. Understanding Angler Exploit Kit - Part 2: Examining Angler EK
  53. Understanding Angler Exploit Kit - Part 1: Exploit Kit Fundamentals
  54. Palo Alto Networks Researchers Uncover Critical Apple Product Vulnerabilities
  55. The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor
  56. New Wekby Attacks Use DNS Requests As Command and Control Mechanism
  57. Operation Ke3chang Resurfaces With New TidePool Malware
  58. Ransomware Is Not a “Malware Problem” – It's a Criminal Business Model
  59. KRBanker Targets South Korea Through Adware and Exploit Kits
  60. Bucbi Ransomware Is Back With a Ukrainian Makeover
  61. AutoFocus Lenz: Taking the Blue (Team) Pill
  62. Prince of Persia: Infy Malware Active In Decade of Targeted Attacks
  63. Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
  64. 2016 Verizon Data Breach Investigations Report (DBIR): Insights from Unit 42
  65. New Poison Ivy RAT Variant Targets Hong Kong Pro-Democracy Activists
  66. Python-Based PWOBot Targets European Organizations
  67. Click-Fraud Ramdo Malware Family Continues to Plague Users
  68. Ransomware: Locky, TeslaCrypt, Other Malware Families Use New Tool To Evade Detection
  69. Don’t Be an April Fool: Inside a Common Phone Scam
  70. How the EITest Campaign's Path to Angler EK Evolved Over Time
  71. Palo Alto Networks Researchers Discover Critical IE Vulnerabilities
  72. ProjectM: Link Found Between Pakistani Actor and Operation Transparent Tribe
  73. Evolution of SamSa Malware Suggests New Ransomware Tactics In Play
  74. Campaign Evolution: Darkleech to Pseudo-Darkleech and Beyond
  75. Locky Ransomware Installed Through Nuclear EK
  76. AceDeceiver: First iOS Trojan Exploiting Apple DRM Design Flaws to Infect Any iOS Device
  77. Digital Quartermaster Scenario Demonstrated in Attacks Against the Mongolian Government
  78. PowerSniff Malware Used in Macro-based Attacks
  79. Palo Alto Networks Researcher Discovers Critical IE Vulnerability
  80. Banload Malware Affecting Brazil Exhibits Unusually Complex Infection Process
  81. New OS X Ransomware KeRanger Infected Transmission BitTorrent Client Installer
  82. New Malware 'Rover' Targets Indian Ambassador to Afghanistan
  83. KeyBase Threat Grows Despite Public Takedown: A Picture is Worth a Thousand Words
  84. Pirated iOS App Store’s Client Successfully Evaded Apple iOS Code Review
  85. New Android Trojan “Xbot” Phishes Credit Cards and Bank Accounts, Encrypts Devices for Ransom
  86. Locky: New Ransomware Mimics Dridex-Style Distribution
  87. A Look Into Fysbis: Sofacy’s Linux Backdoor
  88. NanoCoreRAT Behind an Increase in Tax-Themed Phishing E-mails
  89. T9000: Advanced Modular Backdoor Uses Complex Anti-Analysis Techniques
  90. Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?
  91. SpiderMal: Deep PassiveDNS Analysis with Maltego
  92. Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists
  93. New Attacks Linked to C0d0so0 Group
  94. NetTraveler Spear-Phishing Email Targets Diplomat of Uzbekistan
  95. Using IDAPython to Make Your Life Easier: Part 5
  96. As Usual, Attackers Were Busy Over the Holiday Season
  97. Angler Exploit Kit Continues to Evade Detection: Over 90,000 Websites Compromised
  98. Using IDAPython to Make Your Life Easier: Part 4
  99. Palo Alto Networks Researcher Discovers Critical Vulnerabilities in Adobe Flash
  100. Using IDAPython to Make Your Life Easier: Part 3

2015 83

  1. Using IDAPython to Make Your Life Easier: Part 2
  2. The Threat Intelligence Research That Mattered to You This Year
  3. Using IDAPython to Make Your Life Easier: Part 1
  4. ProxyBack Malware Turns User Systems Into Proxies Without Consent
  5. BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger
  6. #PANWchat Wrap-Up: The 2016 Threat Landscape
  7. Attack on French Diplomat Linked to Operation Lotus Blossom
  8. iOS Trojan “TinyV” Attacks Jailbroken Devices
  9. Palo Alto Networks Researchers Discover Critical Vulnerabilities in Internet Explorer and Microsoft Edge
  10. Palo Alto Networks Researchers Discover High Severity Vulnerability Impacting Apple’s Major Products
  11. BackStab: Mobile Backup Data Under Attack from Malware
  12. Rootnik Android Trojan Abuses Commercial Rooting Tool and Steals Private Information
  13. Adversaries and Their Motivations (Part 3)
  14. Attack Campaign on the Government of Thailand Delivers Bookworm Trojan
  15. Our Commitment to Sharing Threat Intelligence
  16. Inside TDrop2: Technical Analysis of new Dark Seoul Malware
  17. Upatre: Old Dog, New [Anti-Analysis] Tricks
  18. TDrop2 Attacks Suggest Dark Seoul Attackers Return
  19. Dormant Malicious Code Discovered on Thousands of Websites
  20. Adversaries and Their Motivations (Part 2)
  21. Palo Alto Networks Researcher Discovers Critical Vulnerabilities in Internet Explorer and Microsoft Edge
  22. Bookworm Trojan: A Model of Modular Architecture
  23. CryptoWall v4 Emerges Days After Cyber Threat Alliance Report
  24. Connecting the Dots in Cyber Threat Campaigns, Part 2: Passive DNS
  25. CryptoWall 3, the Cyber Threat Alliance and the Future of Information Sharing
  26. Understanding and Preventing Point of Sale Attacks
  27. Palo Alto Networks Researcher Discovers Critical IE Vulnerability
  28. Adversaries and Their Motivations (Part 1)
  29. Chinese Taomike Monetization Library Steals SMS Messages
  30. Surveillance Malware Trends: Tracking Predator Pain and HawkEye
  31. Connecting the Dots in Cyber Threat Campaigns, Part 1: Domain Name WHOIS Information
  32. Latest TeslaCrypt Ransomware Borrows Code From Carberp Trojan
  33. Ticked Off: Upatre Malware’s Simple Anti-analysis Trick to Defeat Sandboxes
  34. Understanding Global Application Usage and Threats to Enterprises
  35. YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs
  36. Dridex is Back and Targeting the UK
  37. Updated PClock Ransomware Still Comes Up Short
  38. Chinese Actors Use ‘3102’ Malware in Attacks on US Government and EU Media
  39. More Details on the XcodeGhost Malware and Affected iOS Apps
  40. Update: XcodeGhost Attacker Can Phish Passwords and Open URLs through Infected Apps
  41. Malware XcodeGhost Infects 39 iOS Apps, Including WeChat, Affecting Hundreds of Millions of Users
  42. Novel Malware XcodeGhost Modifies Xcode, Infects Apple iOS Apps and Hits App Store
  43. Palo Alto Networks Researchers Discover Critical Vulnerabilities in Internet Explorer and Adobe Shockwave Player
  44. Musical Chairs: Multi-Year Campaign Involving New Variant of Gh0st Malware
  45. KeyRaider iOS Malware: How to Keep Yourself Safe
  46. KeyRaider: iOS Malware Steals Over 225,000 Apple Accounts to Create Free App Utopia
  47. Banking Trojan Escelar Infects Thousands In Brazil and the US
  48. RTF Exploit Installs Italian RAT: uWarrior
  49. Retefe Banking Trojan Targets Sweden, Switzerland and Japan
  50. What’s Next in Malware After Kuluoz?
  51. UPS: Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload
  52. Watering Hole Attack on Aerospace Firm Exploits CVE-2015-5122 to Install IsSpace Backdoor
  53. Palo Alto Networks Researcher Discovers Two Critical Internet Explorer Vulnerabilities
  54. Unit 42 Technical Analysis: Seaduke
  55. Tracking MiniDionis: CozyCar’s New Ride Is Related to Seaduke
  56. APT Group UPS Targets US Government with Hacking Team Flash Exploit
  57. New Android Malware Family Evades Antivirus Detection by Using Popular Ad Libraries
  58. Operation Lotus Blossom: A New Nation-State Cyberthreat?
  59. Evilgrab Delivered by Watering Hole Attack on President of Myanmar’s Website
  60. Palo Alto Networks Researcher Discovers 3 Critical Internet Explorer Vulnerabilities
  61. KeyBase Keylogger Malware Family Exposed
  62. Understanding Flash Exploitation and the Alleged CVE-2015-0359 Exploit
  63. The Latest Flash UAF Vulnerabilities in Exploit Kits
  64. Cmstar Downloader: Lurid and Enfal's New Cousin
  65. Palo Alto Networks Researcher Discovers 3 Critical Internet Explorer Vulnerabilities
  66. Trapwot Scareware Activity Spikes in April
  67. PlugX Uses Legitimate Samsung Application for DLL Side-Loading
  68. 2015 Verizon Data Breach Investigations Report (DBIR): Insights from Unit 42
  69. Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets
  70. Android Installer Hijacking Vulnerability Could Expose Android Users to Malware
  71. FindPOS: New POS Malware Family Discovered
  72. Palo Alto Networks Researcher Identifies Critical Internet Explorer Vulnerability
  73. Have You Seen the Latest Threat Intelligence Research from Unit 42?
  74. Examining the Cybercrime Underground, Part 1: Crypters
  75. Palo Alto Networks Researcher Identifies 3 Critical Internet Explorer Vulnerabilities
  76. Watch Our Researchers Cover Predicting Malicious Domains at VB2014
  77. Filmkan: Mysterious Turkish Botnet Grows Through Facebook
  78. Analysis: CryptoWall 3.0, Dyre and I2P
  79. How To Protect Yourself From the Latest CTB-Locker Campaign
  80. Newest CTB-Locker Campaign Bypasses Legacy Security Products
  81. Scareware App Downloaded Over a Million Times from Google Play
  82. Our Favorite Presentations from ShmooCon 2015
  83. Dridex Banking Trojan Begins 2015 with a Bang

2014 69

  1. Don’t Miss A Single Threat Intelligence Update from Unit 42!
  2. CoolReaper Revealed: A Backdoor in Coolpad Android Devices
  3. Google Chrome Exploitation – A Case Study
  4. Unit 42 Explores Malware Attack Vectors in Key Industries
  5. DTLS Vulnerabilities in CVE-2014-6321
  6. How Malware Trends Affect Key Industries, From Healthcare to High Tech
  7. Learn More About WireLurker and the Impact to OS X and iOS
  8. Code to Trigger MS14-066 ECDSA Server BOF Vulnerability
  9. Follow-On to VBA-Initiated Infostealer Campaign: Exploring Related Malware and Actors
  10. Addressing CVE-2014-6332 SWF Exploit
  11. Protecting Users from iOS App Provisioning Profile Abuse
  12. Don’t Forget to Subscribe to Unit 42 Threat Intelligence Alerts
  13. Tracking the WireLurker Arrests
  14. Palo Alto Networks Identifies 3 Critical Internet Explorer Vulnerabilities
  15. The Question of WireLurker Attribution: Who Is Responsible?
  16. Kuluoz Trends – October 2014
  17. WireLurker for Windows
  18. WireLurker: A New Era in OS X and iOS Malware
  19. Examining a VBA-Initiated Infostealer Campaign
  20. Dridex Banking Trojan Distributed Through Word Documents
  21. Tracking New Ransomware CryptoWall 2.0
  22. POODLE like it’s 1999
  23. Super Tuesday: A Patch Tuesday We Won’t Forget
  24. Palo Alto Networks Identifies Critical Internet Explorer Vulnerability
  25. Rovnix and the Declaration Generation Algorithm
  26. New Indicators of Compromise for APT Group Nitro Uncovered
  27. Malware Trending: STUN Awareness
  28. Palo Alto Networks Addresses Bash Vulnerability Shellshock: Mitigation for CVE-2014-6271
  29. We Know It Before You Do: Predicting Malicious Domains
  30. Recent Watering Hole Attacks Attributed to APT Group “th3bug” Using Poison Ivy
  31. Privacy: Why Apple Pay will be Better than Google Wallet
  32. AppBuyer: New iOS Malware Steals Apple ID and Password to Buy Apps
  33. Palo Alto Networks Identifies 15 Critical Internet Explorer Vulnerabilities
  34. Stolen Email Accounts of World’s Top Universities Selling on China’s Largest C2C Platform
  35. Bad Certificate Management in Google Play Store
  36. Listen: How Evolved 419 Scammers Are Targeting the Enterprise
  37. NetWire and MITRE ChopShop
  38. Pivot on Google Code C2 Reveals Additional Malware
  39. Examining the CHS Breach and Heartbleed Exploitation
  40. Insecure Internal Storage in Android
  41. Palo Alto Networks Discovers 3 Critical Internet Explorer Vulnerabilities
  42. Attacks on East Asia using Google Code for Command and Control
  43. Hunting the Mutex
  44. Check Out Scenes from Palo Alto Networks at Black Hat 2014
  45. Black Hat 2014: Threat Intelligence With an Emphasis On Context
  46. Where To Find Palo Alto Networks At Black Hat 2014
  47. Palo Alto Networks Provides a New Breed of Intelligence to Detect and Prevent
  48. Backoff and Citadel Abuse Remote Access Tools
  49. New Release: Decrypting NetWire C2 Traffic
  50. Meet the Unit 42 Team at Black Hat 2014
  51. Palo Alto Networks News of the Week – July 25
  52. Unit 42: A New Era In Threat Intelligence
  53. Why Havex Is a Game-Changing Threat to Industrial Control Systems – Part 2
  54. Black Hat 2014 Is Right Around the Corner…
  55. Why Havex Is a Game-Changing Threat to Industrial Control Systems – Part 1
  56. Is It the Beginning of the End For Use-After-Free Exploitation?
  57. Iptables Backdoor: Even Linux Is At Risk of Intrusion
  58. SMS-Based In-App Purchase on Android Is Not Worth The Risk
  59. Palo Alto Networks Identifies 21 New Critical Vulnerabilities in Internet Explorer
  60. How To Defend Against Advanced IE Exploitation
  61. How Well Do You Understand Your Cyber Adversary? – Part 3
  62. The Latest Kuluoz Spam Campaign Kicks Off
  63. How Well Do You Understand Your Cyber Adversary? – Part 2
  64. How Well Do You Understand Your Cyber Adversary? - Part 1
  65. Funtasy Trojan Targets Spanish Android Users with Sneaky SMS Charges
  66. A Tale of 3 Vulnerabilities, CVE-2014-1776 Exploit Linked to Previous Attacks
  67. Palo Alto Networks Protects Customers From Critical IE Vulnerability CVE-2014-1776
  68. Cardbuyer: New Smart Android Trojan Defeats Multi-factor Verification and Steals Prepaid Game Cards
  69. 8 Tips For Dealing With Heartbleed Right Now