Unit 42 https://unit42.paloaltonetworks.com/ Palo Alto Networks Wed, 29 Jul 2026 20:45:07 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.5 https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-Unit42-180x180-1.png Unit 42 https://unit42.paloaltonetworks.com/ 32 32 noPalo Alto Networks Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ Thu, 30 Jul 2026 10:00:52 +0000 https://unit42.paloaltonetworks.com/?p=184241 Unit 42 details a Chinese speaking threat actor combining autonomous AI scanning across seven vulnerabilities with manual exploitation. Read more.

The post Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks appeared first on Unit 42.

]]> 10 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/AdobeStock_992950050-3-300x300.jpeg 10 Unit 42 details a Chinese speaking threat actor combining autonomous AI scanning across seven vulnerabilities with manual exploitation. Read more. The post Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks appeared first on Unit 42.Unit 42 details a Chinese speaking threat actor combining autonomous AI scanning across seven vulnerabilities with manual exploitation. Read more. The post Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks appeared first on Unit 42.Threat Research, Vulnerabilities, ChatGPT, Claude code, CVEs, DeepSeek, exploitation, Hermes Agent Russian Global Webmail Espionage https://unit42.paloaltonetworks.com/russian-webmail-espionage/ Thu, 23 Jul 2026 14:10:53 +0000 https://unit42.paloaltonetworks.com/?p=184075 Unit 42 details a Russian cyberespionage campaign targeting Zimbra webmail servers using JavaScript injection to steal credentials.

The post Russian Global Webmail Espionage appeared first on Unit 42.

]]> 3 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Nation-State-cyberattacks_1920x900-1-300x300.jpg 3 Unit 42 details a Russian cyberespionage campaign targeting Zimbra webmail servers using JavaScript injection to steal credentials. The post Russian Global Webmail Espionage appeared first on Unit 42.Unit 42 details a Russian cyberespionage campaign targeting Zimbra webmail servers using JavaScript injection to steal credentials. The post Russian Global Webmail Espionage appeared first on Unit 42.Cybercrime, Threat Research, CL-STA-1114, JavaScript, javascript injection, Nation-state, obfuscation, phishing, Zimbra webmail Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/ Fri, 17 Jul 2026 10:00:24 +0000 https://unit42.paloaltonetworks.com/?p=183790 A technical analysis of three chained zero-day vulnerabilities in Siemens ROX II OT switches that allow privilege escalation and persistent root access.

The post Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy appeared first on Unit 42.

]]> 9 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/03_Vulnerabilities_1920x900-300x300.jpg 9 A technical analysis of three chained zero-day vulnerabilities in Siemens ROX II OT switches that allow privilege escalation and persistent root access. The post Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy appeared first on Unit 42.A technical analysis of three chained zero-day vulnerabilities in Siemens ROX II OT switches that allow privilege escalation and persistent root access. The post Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy appeared first on Unit 42.Threat Research, Vulnerabilities, Command injection, CVE-2025-40947, CVE-2025-40948, CVE-2025-40949, Exploit Chain, privilege escalation, Rox II OT switches AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report https://unit42.paloaltonetworks.com/ai-insights-incident-response-report/ Thu, 16 Jul 2026 23:00:59 +0000 https://unit42.paloaltonetworks.com/?p=183816 Explore Unit 42's perspectives on AI's impact on cybersecurity, including key updates since the 2026 Incident Response Report.

The post AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report appeared first on Unit 42.

]]> 5 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/03_Opinion_Category_1505x922-1-300x300.jpg 5 Explore Unit 42's perspectives on AI's impact on cybersecurity, including key updates since the 2026 Incident Response Report. The post AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report appeared first on Unit 42.Explore Unit 42's perspectives on AI's impact on cybersecurity, including key updates since the 2026 Incident Response Report. The post AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report appeared first on Unit 42.Insights, Opinions, AI, LLM, Unit 42 Incident Response Report The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/ Wed, 15 Jul 2026 23:00:33 +0000 https://unit42.paloaltonetworks.com/?p=179395 Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage attacks and more.

The post The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) appeared first on Unit 42.

]]> 27 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/05_Malware_Category_1920x900-300x300.jpg 27 Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage attacks and more. The post The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) appeared first on Unit 42.Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage attacks and more. The post The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) appeared first on Unit 42.High Profile Threats, Malware, Credential Harvesting, GitHub, npm packages, obfuscation, payload, supply chain, worm propagation TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/ Wed, 15 Jul 2026 10:00:54 +0000 https://unit42.paloaltonetworks.com/?p=183516 TuxBot v3 Evolution, an IoT botnet framework built with LLMs. Read our analysis of its cross-compiled binaries, C2 architecture and bugs.

The post TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development appeared first on Unit 42.

]]> 23 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/AdobeStock_992950050-1-300x300.jpeg 23 TuxBot v3 Evolution, an IoT botnet framework built with LLMs. Read our analysis of its cross-compiled binaries, C2 architecture and bugs. The post TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development appeared first on Unit 42.TuxBot v3 Evolution, an IoT botnet framework built with LLMs. Read our analysis of its cross-compiled binaries, C2 architecture and bugs. The post TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development appeared first on Unit 42.Malware, Threat Research, C2, DGA, docker compose, malware, TuxBot v3 Evolution, VirusTotal, XOR No Manners Here: The Ruthless Rise of The Gentlemen Ransomware https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/ Fri, 10 Jul 2026 22:00:39 +0000 https://unit42.paloaltonetworks.com/?p=183458 Unit 42 explores The Gentlemen ransomware operations, revealing the affiliate model driving its rapid growth. Learn more here.

The post No Manners Here: The Ruthless Rise of The Gentlemen Ransomware appeared first on Unit 42.

]]> 5 https://unit42.paloaltonetworks.com/wp-content/uploads/2025/09/05_Opinion_Overview_1920x900-300x300.jpg 5 Unit 42 explores The Gentlemen ransomware operations, revealing the affiliate model driving its rapid growth. Learn more here. The post No Manners Here: The Ruthless Rise of The Gentlemen Ransomware appeared first on Unit 42.Unit 42 explores The Gentlemen ransomware operations, revealing the affiliate model driving its rapid growth. Learn more here. The post No Manners Here: The Ruthless Rise of The Gentlemen Ransomware appeared first on Unit 42.Hospitality Hacks and Retail Reality Checks, Insights, Howling Scorpius, RaaS, Spikey Scorpius Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/ Tue, 07 Jul 2026 22:00:21 +0000 https://unit42.paloaltonetworks.com/?p=183287 A cybercrime campaign combined a loader-as-a-service framework and DLL sideloading via a Go-compiled fake MpClient.dll, a novel evasion layer combination.

The post Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation appeared first on Unit 42.

]]> 10 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/01_Malware_Category_1920x900-2-300x300.jpg 10 A cybercrime campaign combined a loader-as-a-service framework and DLL sideloading via a Go-compiled fake MpClient.dll, a novel evasion layer combination. The post Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation appeared first on Unit 42.A cybercrime campaign combined a loader-as-a-service framework and DLL sideloading via a Go-compiled fake MpClient.dll, a novel evasion layer combination. The post Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation appeared first on Unit 42.Malware, Threat Research, AMSI, Cryptocurrency, DLL Sideloading, Factory-v3, malvertising, X3D MINER How We Added WebAuthn to a Browser-Based RDP Client https://unit42.paloaltonetworks.com/webauthn-added-to-browser-based-rdp/ Thu, 02 Jul 2026 22:00:39 +0000 https://unit42.paloaltonetworks.com/?p=183236 A look inside the reverse-engineering journey of building the first RDP client outside of Windows to support WebAuthn redirection.

The post How We Added WebAuthn to a Browser-Based RDP Client appeared first on Unit 42.

]]> 8 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Myth-Busting_Overview_1920x900-300x300.jpg 8 A look inside the reverse-engineering journey of building the first RDP client outside of Windows to support WebAuthn redirection. The post How We Added WebAuthn to a Browser-Based RDP Client appeared first on Unit 42.A look inside the reverse-engineering journey of building the first RDP client outside of Windows to support WebAuthn redirection. The post How We Added WebAuthn to a Browser-Based RDP Client appeared first on Unit 42.General, Insights, Threat Research, IDA Pro, Microsoft, RDP Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/ Wed, 01 Jul 2026 01:00:11 +0000 https://unit42.paloaltonetworks.com/?p=183096 Attackers can exploit LLM domain hallucinations through phantom squatting to target supply chains. Read the analysis to learn more.

The post Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector appeared first on Unit 42.

]]> 19 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/AdobeStock_799983387-1-1-300x300.jpg 19 Attackers can exploit LLM domain hallucinations through phantom squatting to target supply chains. Read the analysis to learn more. The post Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector appeared first on Unit 42.Attackers can exploit LLM domain hallucinations through phantom squatting to target supply chains. Read the analysis to learn more. The post Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector appeared first on Unit 42.Malware, Threat Research, Agentic AI, LLMs, Malicious Domains, malvertising, Phantom Squatting, phishing, slopsquatting, supply chain, URL hallucination Threat Brief: Mitigating Large-Scale Credential Attacks https://unit42.paloaltonetworks.com/large-scale-credential-attacks/ Fri, 26 Jun 2026 19:05:33 +0000 https://unit42.paloaltonetworks.com/?p=182713 We provide guidance for preparing for and mitigating large-scale credential attacks, focusing on recent campaigns targeting security vendors' devices.

The post Threat Brief: Mitigating Large-Scale Credential Attacks appeared first on Unit 42.

]]> 5 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/07_Vulnerabilities_1920x900-1-300x300.jpg 5 We provide guidance for preparing for and mitigating large-scale credential attacks, focusing on recent campaigns targeting security vendors' devices. The post Threat Brief: Mitigating Large-Scale Credential Attacks appeared first on Unit 42.We provide guidance for preparing for and mitigating large-scale credential attacks, focusing on recent campaigns targeting security vendors' devices. The post Threat Brief: Mitigating Large-Scale Credential Attacks appeared first on Unit 42.General, High Profile Threats, credential theft, fortibleed, password spraying CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure https://unit42.paloaltonetworks.com/cl-sta-1062-tinyrct-backdoor/ Thu, 25 Jun 2026 22:00:52 +0000 https://unit42.paloaltonetworks.com/?p=182868 Government entities and critical infrastructure were targeted for espionage in SE Asia by attackers using a hybrid toolkit, including custom TinyRCT backdoor.

The post CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure appeared first on Unit 42.

]]> 10 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/03_Malware_Category_1920x900-5-300x300.jpg 10 Government entities and critical infrastructure were targeted for espionage in SE Asia by attackers using a hybrid toolkit, including custom TinyRCT backdoor. The post CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure appeared first on Unit 42.Government entities and critical infrastructure were targeted for espionage in SE Asia by attackers using a hybrid toolkit, including custom TinyRCT backdoor. The post CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure appeared first on Unit 42.Malware, Threat Research, backdoor, CL-STA-1062, malware, Mimikatz, southeast asia, TinyRCT, VPN, web shells OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/ Tue, 23 Jun 2026 22:00:51 +0000 https://unit42.paloaltonetworks.com/?p=182742 Unit 42's analysis of ClawHub revealed evasive malicious skills bypassing automated scanners to deploy infostealers and execute agentic financial fraud.

The post OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat appeared first on Unit 42.

]]> 9 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/AdobeStock_768915868-1-300x300.jpg 9 Unit 42's analysis of ClawHub revealed evasive malicious skills bypassing automated scanners to deploy infostealers and execute agentic financial fraud. The post OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat appeared first on Unit 42.Unit 42's analysis of ClawHub revealed evasive malicious skills bypassing automated scanners to deploy infostealers and execute agentic financial fraud. The post OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat appeared first on Unit 42.Malware, Threat Research, Agentic AI, ClawHavoc, ClawHub, defense evasion, Infostealer, OpenClaw, payload, VirusTotal The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/ Mon, 22 Jun 2026 22:00:04 +0000 https://unit42.paloaltonetworks.com/?p=182610 Unit 42 research details how attackers could exploit global name uniqueness in bucket hijacking to redirect cloud data streams across major CSPs.

The post The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration appeared first on Unit 42.

]]> 13 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/09_Cloud_cybersecurity_research_Overview_1920x900-300x300.jpg 13 Unit 42 research details how attackers could exploit global name uniqueness in bucket hijacking to redirect cloud data streams across major CSPs. The post The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration appeared first on Unit 42.Unit 42 research details how attackers could exploit global name uniqueness in bucket hijacking to redirect cloud data streams across major CSPs. The post The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration appeared first on Unit 42.Cloud Cybersecurity Research, Threat Research, AWS, bucket hijacking, cloud data exfiltration, cloud logging, CSPs, Google Cloud, IAM, Microsoft Azure, privilege escalation Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/ Tue, 16 Jun 2026 10:00:29 +0000 https://unit42.paloaltonetworks.com/?p=182510 Unit 42 discovered a Vertex AI Python SDK vulnerability that allows remote code execution via bucket squatting. Read the article for more.

The post Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE appeared first on Unit 42.

]]> 12 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/AdobeStock_1270203474-1-300x300.png 12 Unit 42 discovered a Vertex AI Python SDK vulnerability that allows remote code execution via bucket squatting. Read the article for more. The post Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE appeared first on Unit 42.Unit 42 discovered a Vertex AI Python SDK vulnerability that allows remote code execution via bucket squatting. Read the article for more. The post Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE appeared first on Unit 42.Cloud Cybersecurity Research, Threat Research, bucket squatting, Google Cloud, joblib, Python, RCE, SDKs, Vertex AI, vulnerability