Unit 42 https://unit42.paloaltonetworks.com/ Palo Alto Networks Fri, 22 May 2026 18:45:17 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.4 https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-Unit42-180x180-1.png Unit 42 https://unit42.paloaltonetworks.com/ 32 32 noPalo Alto Networks Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns https://unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens/ Fri, 22 May 2026 13:00:42 +0000 https://unit42.paloaltonetworks.com/?p=181080 Unit 42 details Screening Serpens' use of AppDomainManager hijacking and new RAT variants to target tech and defense sectors in recent campaigns.

The post Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns appeared first on Unit 42.

]]> 20 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/Boggy-Serpens-300x240.png 20 Unit 42 details Screening Serpens' use of AppDomainManager hijacking and new RAT variants to target tech and defense sectors in recent campaigns. The post Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns appeared first on Unit 42.Unit 42 details Screening Serpens' use of AppDomainManager hijacking and new RAT variants to target tech and defense sectors in recent campaigns. The post Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns appeared first on Unit 42.Malware, Threat Actor Groups, Advanced Persistent Threat, AppDomainManager, DLL Sideloading, Iran, MiniJunk, MiniUpdate, operation security, RATs, screening serpens, social engineering Paved With Intent: ROADtools and Nation-State Tactics in the Cloud https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/ Fri, 22 May 2026 10:00:24 +0000 https://unit42.paloaltonetworks.com/?p=181397 Open-source framework ROADtools is being misused by threat actors for cloud intrusions. Learn how to identify its malicious use.

The post Paved With Intent: ROADtools and Nation-State Tactics in the Cloud appeared first on Unit 42.

]]> 14 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/10_Cloud_cybersecurity_research_Overview_1920x900-1-300x300.jpg 14 Open-source framework ROADtools is being misused by threat actors for cloud intrusions. Learn how to identify its malicious use. The post Paved With Intent: ROADtools and Nation-State Tactics in the Cloud appeared first on Unit 42.Open-source framework ROADtools is being misused by threat actors for cloud intrusions. Learn how to identify its malicious use. The post Paved With Intent: ROADtools and Nation-State Tactics in the Cloud appeared first on Unit 42.Cloud Cybersecurity Research, Threat Research, Curious Serpens, Entra ID, Microsoft Azure, Microsoft graph API, Midnight Blizzard, MITRE, ROADtools, UTA0355, Void Blizzard The npm Threat Landscape: Attack Surface and Mitigations (Updated May 21) https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/ Thu, 21 May 2026 15:30:33 +0000 https://unit42.paloaltonetworks.com/?p=179395 Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage attacks and more.

The post The npm Threat Landscape: Attack Surface and Mitigations (Updated May 21) appeared first on Unit 42.

]]> 22 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/05_Malware_Category_1920x900-300x300.jpg 22 Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage attacks and more. The post The npm Threat Landscape: Attack Surface and Mitigations (Updated May 21) appeared first on Unit 42.Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage attacks and more. The post The npm Threat Landscape: Attack Surface and Mitigations (Updated May 21) appeared first on Unit 42.High Profile Threats, Malware, Credential Harvesting, GitHub, npm packages, obfuscation, payload, supply chain, worm propagation Tracking TamperedChef Clusters via Certificate and Code Reuse https://unit42.paloaltonetworks.com/tracking-tampered-chef-clusters/ Wed, 20 May 2026 10:00:46 +0000 https://unit42.paloaltonetworks.com/?p=180970 Unit 42 analyzes TamperedChef malware clusters that use trojanized productivity apps and malvertising to deliver stealthy payloads to targets.

The post Tracking TamperedChef Clusters via Certificate and Code Reuse appeared first on Unit 42.

]]> 21 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/07_Security-Technology_Category_1505x922-300x300.jpg 21 Unit 42 analyzes TamperedChef malware clusters that use trojanized productivity apps and malvertising to deliver stealthy payloads to targets. The post Tracking TamperedChef Clusters via Certificate and Code Reuse appeared first on Unit 42.Unit 42 analyzes TamperedChef malware clusters that use trojanized productivity apps and malvertising to deliver stealthy payloads to targets. The post Tracking TamperedChef Clusters via Certificate and Code Reuse appeared first on Unit 42.Malware, Threat Research, Adware, Appsuite PDF, certificates, CL-CRI-1089, CL-UNK-1090, DocuFlex, EvilAI, malvertising, RATs, Remote Access Trojan, TamperedChef Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files https://unit42.paloaltonetworks.com/gremlin-stealer-evolution/ Fri, 15 May 2026 10:00:52 +0000 https://unit42.paloaltonetworks.com/?p=180614 Unit 42 analyzes the evolution of Gremlin stealer. This variant uses advanced obfuscation, crypto clipping and session hijacking to compromise data.

The post Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files appeared first on Unit 42.

]]> 7 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/02_Malware_Category_1920x900-300x300.jpg 7 Unit 42 analyzes the evolution of Gremlin stealer. This variant uses advanced obfuscation, crypto clipping and session hijacking to compromise data. The post Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files appeared first on Unit 42.Unit 42 analyzes the evolution of Gremlin stealer. This variant uses advanced obfuscation, crypto clipping and session hijacking to compromise data. The post Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files appeared first on Unit 42.Malware, Threat Research, API, Cryptocurrency, gremlin stealer, obfuscation, payload, Telegram, VirusTotal Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools https://unit42.paloaltonetworks.com/active-directory-certificate-services-exploitation/ Mon, 11 May 2026 22:00:43 +0000 https://unit42.paloaltonetworks.com/?p=180347 Unit 42 analyzes AD CS exploitation through template misconfigurations and shadow credential misuse while offering behavioral detection for defenders.

The post Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools appeared first on Unit 42.

]]> 14 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/04_Malware_Category_1920x900-2-300x300.jpg 14 Unit 42 analyzes AD CS exploitation through template misconfigurations and shadow credential misuse while offering behavioral detection for defenders. The post Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools appeared first on Unit 42.Unit 42 analyzes AD CS exploitation through template misconfigurations and shadow credential misuse while offering behavioral detection for defenders. The post Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools appeared first on Unit 42.Malware, Threat Research, Active Directory, AD CS attacks, certificate template, certipy, ESC1, Fighting Ursa, Microsoft, PKI, shadow credentials Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution https://unit42.paloaltonetworks.com/captive-portal-zero-day/ Thu, 07 May 2026 00:00:53 +0000 https://unit42.paloaltonetworks.com/?p=180214 Unit 42 details CVE-2026-0300, a buffer overflow vulnerability in the PAN-OS User-ID Authentication Portal. Read now for details.

The post Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution appeared first on Unit 42.

]]> 5 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/06_Vulnerabilities_1920x900-3-1-300x300.jpg 5 Unit 42 details CVE-2026-0300, a buffer overflow vulnerability in the PAN-OS User-ID Authentication Portal. Read now for details. The post Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution appeared first on Unit 42.Unit 42 details CVE-2026-0300, a buffer overflow vulnerability in the PAN-OS User-ID Authentication Portal. Read now for details. The post Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution appeared first on Unit 42.High Profile Threats, Vulnerabilities, CVE-2026-0300, EarthWorm, PAN-OS, Remote Code Execution, ReverseSocks5, vulnerability, zero-day Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/ Tue, 05 May 2026 23:00:33 +0000 https://unit42.paloaltonetworks.com/?p=180179 Copy Fail (CVE-2026-31431) is a critical Linux kernel LPE that allows stealthy root access. This flaw impacts millions of systems. Read our analysis.

The post Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years appeared first on Unit 42.

]]> 6 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Vulnerabilities_1920x900-2-1-300x300.jpg 6 Copy Fail (CVE-2026-31431) is a critical Linux kernel LPE that allows stealthy root access. This flaw impacts millions of systems. Read our analysis. The post Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years appeared first on Unit 42.Copy Fail (CVE-2026-31431) is a critical Linux kernel LPE that allows stealthy root access. This flaw impacts millions of systems. Read our analysis. The post Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years appeared first on Unit 42.High Profile Threats, Vulnerabilities, Containers, CVE-2026-31431, Kubernetes, Linux, local privilege escalation, page cache, vulnerability Essential Data Sources for Detection Beyond the Endpoint https://unit42.paloaltonetworks.com/detection-beyond-the-endpoint/ Fri, 01 May 2026 23:00:13 +0000 https://unit42.paloaltonetworks.com/?p=180120 Unit 42 highlights the need for a comprehensive security strategy that spans every IT zone. Explore the full details here.

The post Essential Data Sources for Detection Beyond the Endpoint appeared first on Unit 42.

]]> 4 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/13_Cloud_cybersecurity_research_Overview_1920x900-300x300.jpg 4 Unit 42 highlights the need for a comprehensive security strategy that spans every IT zone. Explore the full details here. The post Essential Data Sources for Detection Beyond the Endpoint appeared first on Unit 42.Unit 42 highlights the need for a comprehensive security strategy that spans every IT zone. Explore the full details here. The post Essential Data Sources for Detection Beyond the Endpoint appeared first on Unit 42.General, Insights, Cloud Security, IAM, incident response, threat detection That AI Extension Helping You Write Emails? It’s Reading Them First https://unit42.paloaltonetworks.com/high-risk-gen-ai-browser-extensions/ Thu, 30 Apr 2026 22:00:57 +0000 https://unit42.paloaltonetworks.com/?p=179576 Unit 42 uncovers high-risk AI browser extensions. Disguised as productivity tools, they steal data, intercept prompts, and exfiltrate passwords. Protect your browser.

The post That AI Extension Helping You Write Emails? It’s Reading Them First appeared first on Unit 42.

]]> 13 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/AdobeStock_739390615-1-300x300.jpg 13 Unit 42 uncovers high-risk AI browser extensions. Disguised as productivity tools, they steal data, intercept prompts, and exfiltrate passwords. Protect your browser. The post That AI Extension Helping You Write Emails? It’s Reading Them First appeared first on Unit 42.Unit 42 uncovers high-risk AI browser extensions. Disguised as productivity tools, they steal data, intercept prompts, and exfiltrate passwords. Protect your browser. The post That AI Extension Helping You Write Emails? It’s Reading Them First appeared first on Unit 42.Malware, Threat Research, AI browser, browser extension, GenAI, Infostealer, malware, Remote Access Trojan, search hijacker, spyware TGR-STA-1030: New Activity in Central and South America https://unit42.paloaltonetworks.com/new-activity-central-south-america/ Fri, 24 Apr 2026 20:30:19 +0000 https://unit42.paloaltonetworks.com/?p=179467 Unit 42 research reports that TGR-STA-1030 remains an active threat, particularly in Central and South America.

The post TGR-STA-1030: New Activity in Central and South America appeared first on Unit 42.

]]> 1 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/01_Nation-State-cyberattacks_1505x922-300x300.jpg 1 Unit 42 research reports that TGR-STA-1030 remains an active threat, particularly in Central and South America. The post TGR-STA-1030: New Activity in Central and South America appeared first on Unit 42.Unit 42 research reports that TGR-STA-1030 remains an active threat, particularly in Central and South America. The post TGR-STA-1030: New Activity in Central and South America appeared first on Unit 42.General, Insights, TGR-STA-1030 Frontier AI and the Future of Defense: Your Top Questions Answered https://unit42.paloaltonetworks.com/frontier-ai-top-questions-answered/ Thu, 23 Apr 2026 20:45:50 +0000 https://unit42.paloaltonetworks.com/?p=179376 What are the next steps for security leaders in this new age of frontier AI? We answer the top 10 questions customers are asking.

The post Frontier AI and the Future of Defense: Your Top Questions Answered appeared first on Unit 42.

]]> 4 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/03_Listicle_Overview_1920x900-300x300.jpg 4 What are the next steps for security leaders in this new age of frontier AI? We answer the top 10 questions customers are asking. The post Frontier AI and the Future of Defense: Your Top Questions Answered appeared first on Unit 42.What are the next steps for security leaders in this new age of frontier AI? We answer the top 10 questions customers are asking. The post Frontier AI and the Future of Defense: Your Top Questions Answered appeared first on Unit 42.General, Insights, GenAI, LLM, n-day, open source Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System https://unit42.paloaltonetworks.com/autonomous-ai-cloud-attacks/ Thu, 23 Apr 2026 10:00:31 +0000 https://unit42.paloaltonetworks.com/?p=178504 Unit 42 reveals how multi-agent AI systems can autonomously attack cloud environments. Learn critical insights and vital lessons for proactive security.

The post Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System appeared first on Unit 42.

]]> 12 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/12_Cloud_cybersecurity_research_Overview_1920x900-300x300.jpg 12 Unit 42 reveals how multi-agent AI systems can autonomously attack cloud environments. Learn critical insights and vital lessons for proactive security. The post Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System appeared first on Unit 42.Unit 42 reveals how multi-agent AI systems can autonomously attack cloud environments. Learn critical insights and vital lessons for proactive security. The post Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System appeared first on Unit 42.Cloud Cybersecurity Research, Threat Research, AI, Cloud, data exfiltration, GCP, Google Cloud, LLMs, multi-agent, penetration testing When Wi-Fi Encryption Fails: Protecting Your Enterprise from AirSnitch Attacks https://unit42.paloaltonetworks.com/air-snitch-enterprise-wireless-attacks/ Wed, 22 Apr 2026 10:00:22 +0000 https://unit42.paloaltonetworks.com/?p=178804 Unit 42 research reveals AirSnitch attacks bypass WPA2/3 Wi-Fi encryption and client isolation, exposing critical infrastructure vulnerabilities.

The post When Wi-Fi Encryption Fails: Protecting Your Enterprise from AirSnitch Attacks appeared first on Unit 42.

]]> 12 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/11_Security-Technology_Category_1505x922-300x300.jpg 12 Unit 42 research reveals AirSnitch attacks bypass WPA2/3 Wi-Fi encryption and client isolation, exposing critical infrastructure vulnerabilities. The post When Wi-Fi Encryption Fails: Protecting Your Enterprise from AirSnitch Attacks appeared first on Unit 42.Unit 42 research reveals AirSnitch attacks bypass WPA2/3 Wi-Fi encryption and client isolation, exposing critical infrastructure vulnerabilities. The post When Wi-Fi Encryption Fails: Protecting Your Enterprise from AirSnitch Attacks appeared first on Unit 42.Malware, Threat Research, AirSnitch, MitM, network security, port stealing, WiFi encryption, wireless, WPA2, WPA3 Fracturing Software Security With Frontier AI Models https://unit42.paloaltonetworks.com/ai-software-security-risks/ Mon, 20 Apr 2026 10:00:14 +0000 https://unit42.paloaltonetworks.com/?p=177819 Unit 42 finds frontier AI models enhance vulnerability discovery, acting as full-spectrum security researchers. They enable autonomous zero-day discovery and faster N-day patching.

The post Fracturing Software Security With Frontier AI Models appeared first on Unit 42.

]]> 6 https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/06_General_Overview_1920x900-300x300.jpg 6 Unit 42 finds frontier AI models enhance vulnerability discovery, acting as full-spectrum security researchers. They enable autonomous zero-day discovery and faster N-day patching. The post Fracturing Software Security With Frontier AI Models appeared first on Unit 42.Unit 42 finds frontier AI models enhance vulnerability discovery, acting as full-spectrum security researchers. They enable autonomous zero-day discovery and faster N-day patching. The post Fracturing Software Security With Frontier AI Models appeared first on Unit 42.General, Insights, AI, attack path, data exfiltration, malware, n-day, Open Source Software, zero-day