Unit 42 conducts cybersecurity research and provides threat intelligence and incident response services. The information is self-described as the latest in the field.

Unit 42

Unit 42 is a research team focused on cybersecurity issues, providing insights and resources related to various threats and vulnerabilities. The organization conducts assessments, incident response, and threat intelligence services, self-described as a leader in cybersecurity intelligence.

Palo Alto Networks Unit 42 | 79,770 followers on LinkedIn. Unit 42 Threat Intelligence &amp; Incident Response. Intelligence Driven. Response Ready. | Palo Alto Networks Unit 42 brings together world-renowned threat researchers with an elite team of incident responders and security consultants to create an intelligence-driven, response-ready organization passionate about helping customers more proactively manage cyber risk. With a deeply rooted reputation for delivering world-class threat intelligence, Unit 42 provides industry-leading incident response and cyber risk management services to security leaders around the globe.

Sr. Product Marketing Manager specializing in Cybersecurity

Sheila Droski

Engagement Director| Principal Cloud Security Architect

Matthew Gale

Senior Consulting Director at Unit 42 by Palo Alto Networks

Matt Armstrong

Director, Unit 42 Offensive Security

Nuri Fattah

Palo Alto Networks Unit 42

We've found #stockpiled domains hosting fake work portals for cryptocurrency #scam , with a traffic spike since Oct 15. Starting in July, this campaign has 60 domains in 3 bulk registrations with distinct naming patterns, all leading to same IP. More info: https://bit.ly/48jduyw

This threat brief on CVE-2024-0012 and CVE-2024-9474 has been revised to include new indicators and updated guidance on post-compromise activity, as well as information on scanning activity: https://bit.ly/4fYK9MF

Plunged into sub-zero temperatures, over 600 apartment buildings in a Ukrainian city experienced interrupted heating services when FrostyGoop malware was used to target a municipal energy company's industrial systems. Since this early 2024 incident, analysts have identified this malware as the first to manipulate Modbus TCP communications. https://bit.ly/3OjdchS

2024-11-19 (Tuesday) We've discovered new infrastructure and domains for the #ApateWeb campaign that includes 2.4k new domains and 5 new IP addresses that lead to sites for potentially unwanted applications ( #PUP ) and #scam pages. More info at https://bit.ly/4fXarik

Our threat brief on CVE-2024-0012 and CVE-2024-9474 has been updated to include new IoCs, as well as expand the Current Scope of the Attack section — read the details now: https://bit.ly/4fYK9MF

1,346 domains registered in the past 3 months, peaking 11/03/24, redirect users to gambling or adult-themed pages distributing potential unwanted programs (PUPs) for Android. Some sites force multiple downloads of the same APK. More info: https://bit.ly/4ewMYU5 #AndroidPUPs

This threat brief outlines the limited exploitation activity observed related to vulnerability CVE-2024-0012, which impacts specific versions of PAN-OS software. Unauthenticated attackers could potentially obtain administrator privileges. A hotfix is available. Read the specifics as well as current protections and mitigations: https://bit.ly/3Za6ctX

We explore the strategies of a North Korean IT worker group involved in phishing attacks targeting video conferencing apps. Unlike other groups that typically rely on Chinese or Russian infrastructures, these attackers have employed resources from Laos. This approach is significant due to its implications for technology, security, and geopolitical dynamics as North Korean attackers become more aggressive in their tactics. Read the full analysis: https://bit.ly/40JUaZx

2024-11-14 (Thursday): #RaspberryRobin infection chain uses WebDAV share, today at 2z[.]si@ssl\u\. Victim downloads a zip archive, then extracts and double-clicks an HTA file, which loads and runs a Raspberry Robin DLL from the WebDAV share. Details at https://bit.ly/3O9XMwA

When planning your holiday vacation, beware of #phishing attacks spoofing various booking sites, restaurants, banks and crypto wallets. From Nov 1st through Nov 9th, one threat actor using ilotirabec207@gmail[.]com registered 550+ domains. More info at https://bit.ly/48Mc93u

PALO

COM:PALOALTONETWORKS:UNIT42

Unit 42