Unit 42 introduces Insights, a new space for fresh thinking and varied content built on trusted expertise. The post Insights: Telling You What We Really Think appeared first on Unit 42. This article has been indexed from Unit 42 Read…
Tag: Unit 42
Your Connection, Their Cash: Threat Actors Misuse SDKs to Sell Your Bandwidth
A campaign leverages CVE-2024-36401 to stealthily monetize victims’ bandwidth where legitimate software development kits (SDKs) are deployed for passive income. The post Your Connection, Their Cash: Threat Actors Misuse SDKs to Sell Your Bandwidth appeared first on Unit 42. This…
Logit-Gap Steering: A New Frontier in Understanding and Probing LLM Safety
New research from Unit 42 on logit-gap steering reveals how internal alignment measures can be bypassed, making external AI security vital. The post Logit-Gap Steering: A New Frontier in Understanding and Probing LLM Safety appeared first on Unit 42. This…
Fashionable Phishing Bait: GenAI on the Hook
GenAI-created phishing campaigns misuse tools ranging from website builders to text generators in order to create more convincing and scalable attacks. The post Fashionable Phishing Bait: GenAI on the Hook appeared first on Unit 42. This article has been indexed…
A Mega Malware Analysis Tutorial Featuring Donut-Generated Shellcode
A beginner-friendly tutorial on analyzing .NET malware teaches you how to use common tools, recognize techniques and understand infection chains. The post A Mega Malware Analysis Tutorial Featuring Donut-Generated Shellcode appeared first on Unit 42. This article has been indexed…
Muddled Libra’s Strike Teams: Amalgamated Evil
A look at the variance within Muddled Libra (aka Scattered Spider, Octo Tempest). Its lack of structure creates multiple teams with distinct skill sets. The post Muddled Libra’s Strike Teams: Amalgamated Evil appeared first on Unit 42. This article has…
Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild
CVE-2025-32433 allows for remote code execution in sshd for certain versions of Erlang programming language’s OTP. We reproduced this CVE and share our findings. The post Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild…
New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer
DarkCloud Stealer’s delivery has shifted. We explore three different attack chains that use ConfuserEx obfuscation and a final payload in Visual Basic 6. The post New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer appeared first on Unit 42. This…
Muddled Libra: Why Are We So Obsessed With You?
Muddled Libra gets media attention due to its consistent playbook and unique use of vishing. The group’s English fluency is another major factor. The post Muddled Libra: Why Are We So Obsessed With You? appeared first on Unit 42. This…
When Good Accounts Go Bad: Exploiting Delegated Managed Service Accounts in Active Directory
BadSuccessor is an attack vector in Windows Server 2025. Under certain conditions it allows privilege elevation via dMSAs. We analyze its mechanics. The post When Good Accounts Go Bad: Exploiting Delegated Managed Service Accounts in Active Directory appeared first on…
Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
Project AK47, a toolset including ransomware, was used to leverage SharePoint exploit chain ToolShell. This activity overlaps with Storm-2603. The post Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks appeared first on Unit 42. This article has been…
Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)
A comprehensive list of threat actor groups tracked by Unit 42, along with information such as summaries and industries typically impacted. The post Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025) appeared first on…
Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated July 31)
Unit 42 has observed active exploitation of recent Microsoft SharePoint vulnerabilities. Here’s how you can protect your organization. The post Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated July 31) appeared first on Unit 42. This article has been…
Introducing Unit 42’s Attribution Framework
Peel back the layers on Unit 42’s Attribution Framework. We offer a rare inside view into the system used to ultimately assign attribution to threat groups. The post Introducing Unit 42’s Attribution Framework appeared first on Unit 42. This article…
2025 Unit 42 Global Incident Response Report: Social Engineering Edition
Social engineering thrives on trust and is now boosted by AI. Unit 42 incident response data explains why it’s surging. We detail eight critical countermeasures. The post 2025 Unit 42 Global Incident Response Report: Social Engineering Edition appeared first on…
Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated July 29)
Unit 42 has observed active exploitation of recent Microsoft SharePoint vulnerabilities. Here’s how you can protect your organization. The post Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated July 29) appeared first on Unit 42. This article has been…
The Covert Operator’s Playbook: Infiltration of Global Telecom Networks
Recent activity targeting telecom infrastructure is assessed with high confidence to overlap with Liminal Panda activity. The actors used custom tools, tunneling and OPSEC tactics for stealth. The post The Covert Operator's Playbook: Infiltration of Global Telecom Networks appeared first…
Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated July 25)
Unit 42 has observed active exploitation of recent Microsoft SharePoint vulnerabilities. Here’s how you can protect your organization. The post Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated July 25) appeared first on Unit 42. This article has been…
The Ηоmоgraph Illusion: Not Everything Is As It Seems
A subtle yet dangerous email attack vector: homograph attacks. Threat actors are using visually similar, non-Latin characters to bypass security filters. The post The Ηоmоgraph Illusion: Not Everything Is As It Seems appeared first on Unit 42. This article has…
Muddled Libra Threat Assessment: Further-Reaching, Faster, More Impactful
Muddled Libra (Scattered Spider, UNC3944) is evolving. Get the latest insights and defensive recommendations based on Unit 42 incident response cases. The post Muddled Libra Threat Assessment: Further-Reaching, Faster, More Impactful appeared first on Unit 42. This article has been…