Unit 42 https://unit42.paloaltonetworks.com/ Palo Alto Networks Wed, 19 Aug 2026 17:59:39 +0000 en-US hourly 1 https://wordpress.org/?v=7.0.4 https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-Unit42-180x180-1.png Unit 42 https://unit42.paloaltonetworks.com/ 32 32 noPalo Alto Networks Identity Abuse Through Trusted Communication Channels https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ Thu, 20 Aug 2026 10:00:25 +0000 https://unit42.paloaltonetworks.com/?p=185799 Unit 42 details how attackers exploit enterprise collaboration tools for identity phishing and credential theft. Discover key defense strategies.

The post Identity Abuse Through Trusted Communication Channels appeared first on Unit 42.

]]> 12 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-300x300.jpg 12 Unit 42 details how attackers exploit enterprise collaboration tools for identity phishing and credential theft. Discover key defense strategies. The post Identity Abuse Through Trusted Communication Channels appeared first on Unit 42.Unit 42 details how attackers exploit enterprise collaboration tools for identity phishing and credential theft. Discover key defense strategies. The post Identity Abuse Through Trusted Communication Channels appeared first on Unit 42.Malware, Threat Research, authentication, identity theft, malware, MFA, remote access software, social engineering Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) https://unit42.paloaltonetworks.com/large-scale-credential-attacks/ Tue, 18 Aug 2026 19:05:33 +0000 https://unit42.paloaltonetworks.com/?p=182713 In August 2026, the actor TheHatman claimed to have stolen large volume of credentials from organizations' Microsoft Entra tenants. We provide guidance on mitigating large-scale credential attacks.

The post Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) appeared first on Unit 42.

]]> 6 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/07_Vulnerabilities_1920x900-1-300x300.jpg 6 In August 2026, the actor TheHatman claimed to have stolen large volume of credentials from organizations' Microsoft Entra tenants. We provide guidance on mitigating large-scale credential attacks. The post Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) appeared first on Unit 42.In August 2026, the actor TheHatman claimed to have stolen large volume of credentials from organizations' Microsoft Entra tenants. We provide guidance on mitigating large-scale credential attacks. The post Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) appeared first on Unit 42.General, High Profile Threats, credential-based attacks, MFA, password spraying, thehatman Kimwolf v7: An Evolution of the Kimwolf Botnet https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ Tue, 11 Aug 2026 10:00:16 +0000 https://unit42.paloaltonetworks.com/?p=185086 Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing.

The post Kimwolf v7: An Evolution of the Kimwolf Botnet appeared first on Unit 42.

]]> 11 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-300x300.jpg 11 Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing. The post Kimwolf v7: An Evolution of the Kimwolf Botnet appeared first on Unit 42.Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing. The post Kimwolf v7: An Evolution of the Kimwolf Botnet appeared first on Unit 42.Malware, Threat Research, Android APK, Ethereum, HTTP, IoT botnets, Kimwolf v7, Linux, RPC, spoofing The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ Mon, 10 Aug 2026 22:00:02 +0000 https://unit42.paloaltonetworks.com/?p=185207 Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure and payload execution.

The post The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications appeared first on Unit 42.

]]> 18 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-300x300.jpg 18 Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure and payload execution. The post The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications appeared first on Unit 42.Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure and payload execution. The post The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications appeared first on Unit 42.Malware, Threat Research, Aeternum, infection chain, JSON, Python, RPC, Telegram, XMRig, XOR Inside the Modern SOC: The Identity Front Door https://unit42.paloaltonetworks.com/soc-identity-front-door/ Fri, 07 Aug 2026 23:00:01 +0000 https://unit42.paloaltonetworks.com/?p=184235 Identity-based attacks drive 90% of incidents. Learn how modern attackers exploit identities and what SOC leaders can do to respond.

The post Inside the Modern SOC: The Identity Front Door appeared first on Unit 42.

]]> 3 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/04_Listicle_Overview_1920x900-300x300.jpg 3 Identity-based attacks drive 90% of incidents. Learn how modern attackers exploit identities and what SOC leaders can do to respond. The post Inside the Modern SOC: The Identity Front Door appeared first on Unit 42.Identity-based attacks drive 90% of incidents. Learn how modern attackers exploit identities and what SOC leaders can do to respond. The post Inside the Modern SOC: The Identity Front Door appeared first on Unit 42.Inside the Modern SOC, Insights, AI, identity, social engineering, Unit 42 Incident Response Report ChainDrop: Inside a Self-Propagating npm Worm https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ Thu, 06 Aug 2026 22:26:39 +0000 https://unit42.paloaltonetworks.com/?p=184924 Analysis of ChainDrop, an npm supply chain worm extracting GitHub Actions runner secrets and using Ethereum smart contracts for C2 routing.

The post ChainDrop: Inside a Self-Propagating npm Worm appeared first on Unit 42.

]]> 20 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-300x300.jpg 20 Analysis of ChainDrop, an npm supply chain worm extracting GitHub Actions runner secrets and using Ethereum smart contracts for C2 routing. The post ChainDrop: Inside a Self-Propagating npm Worm appeared first on Unit 42.Analysis of ChainDrop, an npm supply chain worm extracting GitHub Actions runner secrets and using Ethereum smart contracts for C2 routing. The post ChainDrop: Inside a Self-Propagating npm Worm appeared first on Unit 42.High Profile Threats, Malware, blockchain, ChainDrop, Claude code, developer tooling, GitHub Token Jacking: Cybercriminals Could Be Stealing Your AI Resources https://unit42.paloaltonetworks.com/ai-token-jacking/ Thu, 06 Aug 2026 10:00:49 +0000 https://unit42.paloaltonetworks.com/?p=184882 Discover how attackers hijack AI tokens to fuel gray market transfer stations by stealing developer API keys.

The post Token Jacking: Cybercriminals Could Be Stealing Your AI Resources appeared first on Unit 42.

]]> 8 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-300x300.jpg 8 Discover how attackers hijack AI tokens to fuel gray market transfer stations by stealing developer API keys. The post Token Jacking: Cybercriminals Could Be Stealing Your AI Resources appeared first on Unit 42.Discover how attackers hijack AI tokens to fuel gray market transfer stations by stealing developer API keys. The post Token Jacking: Cybercriminals Could Be Stealing Your AI Resources appeared first on Unit 42.Malware, Threat Research, AI API, AI gateway, API keys, npm packages, obfuscation, token jacking, transfer stations The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/ Tue, 04 Aug 2026 13:00:11 +0000 https://unit42.paloaltonetworks.com/?p=183957 Frontier AI is reshaping vulnerability discovery. Learn how our NOVA system found 14,000+ unknown vulnerabilities across the open-source software supply chain.

The post The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software appeared first on Unit 42.

]]> 11 https://unit42.paloaltonetworks.com/wp-content/uploads/2025/09/11_Myth-Busting_Overview_1920x900-300x300.jpg 11 Frontier AI is reshaping vulnerability discovery. Learn how our NOVA system found 14,000+ unknown vulnerabilities across the open-source software supply chain. The post The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software appeared first on Unit 42.Frontier AI is reshaping vulnerability discovery. Learn how our NOVA system found 14,000+ unknown vulnerabilities across the open-source software supply chain. The post The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software appeared first on Unit 42.General, Insights, Vulnerabilities, AI, Frontier AI, Vulnerability Exploitation, zero-day Almost Half of Malware Samples Communicate Direct to IP https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/ Tue, 04 Aug 2026 12:50:53 +0000 https://unit42.paloaltonetworks.com/?p=184389 Nearly half of C2 malware bypasses DNS by connecting directly to IP addresses. Zero trust IP enforcement secures networks against these threats.

The post Almost Half of Malware Samples Communicate Direct to IP appeared first on Unit 42.

]]> 9 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_DNS_Overview_1920x900-300x300.jpg 9 Nearly half of C2 malware bypasses DNS by connecting directly to IP addresses. Zero trust IP enforcement secures networks against these threats. The post Almost Half of Malware Samples Communicate Direct to IP appeared first on Unit 42.Nearly half of C2 malware bypasses DNS by connecting directly to IP addresses. Zero trust IP enforcement secures networks against these threats. The post Almost Half of Malware Samples Communicate Direct to IP appeared first on Unit 42.Malware, Threat Research, Command and Control, D2IP, exfiltration, IoT botnets, IP traffic, Mozi, Phorpiex, ransomware, SectopRAT, Zero trust IP, ZT-IP Pass the Passkey: A Novel Attack Surface in Passwordless Authentication https://unit42.paloaltonetworks.com/passwordless-authentication-security-risks/ Mon, 03 Aug 2026 10:00:35 +0000 https://unit42.paloaltonetworks.com/?p=184120 Explore how passkey implementation gaps undermine security when relying parties fail to validate the User Verified flag, reducing MFA to a single factor.

The post Pass the Passkey: A Novel Attack Surface in Passwordless Authentication appeared first on Unit 42.

]]> 17 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/07_Cloud_cybersecurity_research_Overview_1920x900-300x300.jpg 17 Explore how passkey implementation gaps undermine security when relying parties fail to validate the User Verified flag, reducing MFA to a single factor. The post Pass the Passkey: A Novel Attack Surface in Passwordless Authentication appeared first on Unit 42.Explore how passkey implementation gaps undermine security when relying parties fail to validate the User Verified flag, reducing MFA to a single factor. The post Pass the Passkey: A Novel Attack Surface in Passwordless Authentication appeared first on Unit 42.Malware, Threat Research, google authenticator, Google Chrome, Google Cloud, identity, key, passkey, passwordless The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version https://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis/ Fri, 31 Jul 2026 10:00:18 +0000 https://unit42.paloaltonetworks.com/?p=183840 Analysis of XCSSET v40 reveals a macOS malware targeting developers via Xcode. Unit 42 used advanced pattern matching and AI to decode its logic.

The post The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version appeared first on Unit 42.

]]> 16 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Malware_Category_1920x900-6-300x300.jpg 16 Analysis of XCSSET v40 reveals a macOS malware targeting developers via Xcode. Unit 42 used advanced pattern matching and AI to decode its logic. The post The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version appeared first on Unit 42.Analysis of XCSSET v40 reveals a macOS malware targeting developers via Xcode. Unit 42 used advanced pattern matching and AI to decode its logic. The post The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version appeared first on Unit 42.Malware, Threat Research, browser hijacking, credential theft, data exfiltration, infection chain, malware, obfuscation, XCSSET malware Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ Thu, 30 Jul 2026 10:00:52 +0000 https://unit42.paloaltonetworks.com/?p=184241 Unit 42 details a Chinese speaking threat actor combining autonomous AI scanning across seven vulnerabilities with manual exploitation. Read more.

The post Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks appeared first on Unit 42.

]]> 10 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/AdobeStock_992950050-3-300x300.jpeg 10 Unit 42 details a Chinese speaking threat actor combining autonomous AI scanning across seven vulnerabilities with manual exploitation. Read more. The post Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks appeared first on Unit 42.Unit 42 details a Chinese speaking threat actor combining autonomous AI scanning across seven vulnerabilities with manual exploitation. Read more. The post Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks appeared first on Unit 42.Threat Research, Vulnerabilities, ChatGPT, Claude code, CVEs, DeepSeek, exploitation, Hermes Agent Russian Global Webmail Espionage https://unit42.paloaltonetworks.com/russian-webmail-espionage/ Thu, 23 Jul 2026 14:10:53 +0000 https://unit42.paloaltonetworks.com/?p=184075 Unit 42 details a Russian cyberespionage campaign targeting Zimbra webmail servers using JavaScript injection to steal credentials.

The post Russian Global Webmail Espionage appeared first on Unit 42.

]]> 3 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Nation-State-cyberattacks_1920x900-1-300x300.jpg 3 Unit 42 details a Russian cyberespionage campaign targeting Zimbra webmail servers using JavaScript injection to steal credentials. The post Russian Global Webmail Espionage appeared first on Unit 42.Unit 42 details a Russian cyberespionage campaign targeting Zimbra webmail servers using JavaScript injection to steal credentials. The post Russian Global Webmail Espionage appeared first on Unit 42.Cybercrime, Threat Research, CL-STA-1114, JavaScript, javascript injection, Nation-state, obfuscation, phishing, Zimbra webmail Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/ Fri, 17 Jul 2026 10:00:24 +0000 https://unit42.paloaltonetworks.com/?p=183790 A technical analysis of three chained zero-day vulnerabilities in Siemens ROX II OT switches that allow privilege escalation and persistent root access.

The post Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy appeared first on Unit 42.

]]> 9 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/03_Vulnerabilities_1920x900-300x300.jpg 9 A technical analysis of three chained zero-day vulnerabilities in Siemens ROX II OT switches that allow privilege escalation and persistent root access. The post Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy appeared first on Unit 42.A technical analysis of three chained zero-day vulnerabilities in Siemens ROX II OT switches that allow privilege escalation and persistent root access. The post Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy appeared first on Unit 42.Threat Research, Vulnerabilities, Command injection, CVE-2025-40947, CVE-2025-40948, CVE-2025-40949, Exploit Chain, privilege escalation, Rox II OT switches AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report https://unit42.paloaltonetworks.com/ai-insights-incident-response-report/ Thu, 16 Jul 2026 23:00:59 +0000 https://unit42.paloaltonetworks.com/?p=183816 Explore Unit 42's perspectives on AI's impact on cybersecurity, including key updates since the 2026 Incident Response Report.

The post AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report appeared first on Unit 42.

]]> 5 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/03_Opinion_Category_1505x922-1-300x300.jpg 5 Explore Unit 42's perspectives on AI's impact on cybersecurity, including key updates since the 2026 Incident Response Report. The post AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report appeared first on Unit 42.Explore Unit 42's perspectives on AI's impact on cybersecurity, including key updates since the 2026 Incident Response Report. The post AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report appeared first on Unit 42.Insights, Opinions, AI, LLM, Unit 42 Incident Response Report