Executive Summary AzureHound is a data collection tool intended for penetration testing that is part of the BloodHound suite. Threat actors misuse this tool to enumerate Azure resources and map potential attack paths, enabling further malicious operations. Here, we help…
Category: Unit 42
The Smishing Deluge: China-Based Campaign Flooding Global Text Messages
Global smishing activity tracked by Unit 42 includes impersonation of many critical services. Its unique ecosystem allows attackers to quickly scale. The post The Smishing Deluge: China-Based Campaign Flooding Global Text Messages appeared first on Unit 42. This article has…
Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign
Threat actors behind the gift card fraud campaign Jingle Thief target retail via phishing and smishing, maintaining long-term access in cloud environments. The post Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign appeared first on Unit 42. This article…
The Golden Scale: Notable Threat Updates and Looking Ahead
Unit 42 shares notable developments of cybercrime group Scattered LAPSUS$ Hunters. Learn how this group may operate in the future. The post The Golden Scale: Notable Threat Updates and Looking Ahead appeared first on Unit 42. This article has been…
Threat Brief: Nation-State Actor Steals F5 Source Code and Undisclosed Vulnerabilities
A nation-state actor stole BIG-IP source code and information on undisclosed vulnerabilities from F5. We explain what sets this theft apart from others. The post Threat Brief: Nation-State Actor Steals F5 Source Code and Undisclosed Vulnerabilities appeared first on Unit…
PhantomVAI Loader Delivers a Range of Infostealers
PhantomVAI is a new loader used to deploy multiple infostealers. We discuss its overall evolution and use of steganography and obfuscated scripts. The post PhantomVAI Loader Delivers a Range of Infostealers appeared first on Unit 42. This article has been…
Anatomy of an Attack: The “BlackSuit Blitz” at a Global Equipment Manufacturer
BlackSuit ransomware delivered by APT Ignoble Scorpius started with a vishing attack. Read how Unit 42 helped and the ultimate outcome. The post Anatomy of an Attack: The "BlackSuit Blitz" at a Global Equipment Manufacturer appeared first on Unit 42.…
The Golden Scale: Bling Libra and the Evolving Extortion Economy
Scattered Lapsus$ Hunters: Organizations, be aware of the effort of this cybercriminal alliance as they target retail and hospitality for extortion. The post The Golden Scale: Bling Libra and the Evolving Extortion Economy appeared first on Unit 42. This article…
When AI Remembers Too Much – Persistent Behaviors in Agents’ Memory
Indirect prompt injection can poison long-term AI agent memory, allowing injected instructions to persist and potentially exfiltrate conversation history. The post When AI Remembers Too Much – Persistent Behaviors in Agents’ Memory appeared first on Unit 42. This article has…
The ClickFix Factory: First Exposure of IUAM ClickFix Generator
Unit 42 discovers ClickFix phishing kits, commoditizing social engineering. This kit presents a lowered barrier for inexperienced cybercriminals. The post The ClickFix Factory: First Exposure of IUAM ClickFix Generator appeared first on Unit 42. This article has been indexed from…
Responding to Cloud Incidents A Step-by-Step Guide from the 2025 Unit 42 Global Incident Response Report
Cloud breaches are rising. This step-by-step guide from Unit 42 shows how to investigate, contain and recover from cloud-based attacks. The post Responding to Cloud Incidents A Step-by-Step Guide from the 2025 Unit 42 Global Incident Response Report appeared first…
TOTOLINK X6000R: Three New Vulnerabilities Uncovered
Researchers identified vulnerabilities in TOTOLINK X6000R routers: CVE-2025-52905, CVE-2025-52906 and CVE-2025-52907. We discuss root cause and impact. The post TOTOLINK X6000R: Three New Vulnerabilities Uncovered appeared first on Unit 42. This article has been indexed from Unit 42 Read the…
Phantom Taurus: 新たな中華系Nexus APTとNET-STARマルウェア スイートの発見
「Phantom Taurus」は、これまで活動が報告されていなかった中国の脅威グループです。本稿では、このグループが使用する特徴的なツールセットが、いかにしてその存在の発見につながったのかを解説します。 The post Phantom Taurus: 新たな中華系Nexus APTとNET-STARマルウェア スイートの発見 appeared first on Unit 42. This article has been indexed from Unit 42 Read the original article: Phantom Taurus: 新たな中華系Nexus APTとNET-STARマルウェア スイートの発見
Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite
Phantom Taurus is a previously undocumented Chinese threat group. Explore how this group’s distinctive toolset lead to uncovering their existence. The post Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite appeared first on…
Threat Insights: Active Exploitation of Cisco ASA Zero Days
CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363 affect multiple Cisco products, and are being exploited by a threat actor linked to the ArcaneDoor campaign. The post Threat Insights: Active Exploitation of Cisco ASA Zero Days appeared first on Unit 42. This article has…
Bookworm to Stately Taurus Using the Unit 42 Attribution Framework
We connect Bookworm malware to Chinese APT Stately Taurus using our attribution framework, enhancing our understanding of threat group tradecraft. The post Bookworm to Stately Taurus Using the Unit 42 Attribution Framework appeared first on Unit 42. This article has…
“Shai-Hulud” Worm Compromises npm Ecosystem in Supply Chain Attack (Updated September 23)
Self-replicating worm “Shai-Hulud” has compromised hundreds of software packages in a supply chain attack targeting the npm ecosystem. We discuss scope and more. The post "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated September 23) appeared first on…
Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign
SEO poisoning campaign “Operation Rewrite” uses a malicious IIS module called BadIIS to redirect users to unwanted websites. The post Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign appeared first on Unit 42. This…
“Shai-Hulud” Worm Compromises npm Ecosystem in Supply Chain Attack (Updated September 18)
Self-replicating worm “Shai-Hulud” has compromised hundreds of software packages in a supply chain attack targeting the npm ecosystem. We discuss scope and more. The post "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated September 18) appeared first on…
“Shai-Hulud” Worm Compromises npm Ecosystem in Supply Chain Attack
Self-replicating worm “Shai-Hulud” has compromised hundreds of software packages in a supply chain attack targeting the npm ecosystem. We discuss scope and more. The post "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack appeared first on Unit 42. This…