#Unit42

@cyberresearch.bsky.social

1 day ago

Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia An espionage operation demonstrated strategic operational patience against targets in Southeast Asia, deploying custom backdoors. The post Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia appeared first on Unit 42.

Originally from Unit 42: Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia ( :-{ı▓ #unit42 #threathunting #cyberresearch

@cyberresearch.bsky.social

2 days ago

Insights: Increased Risk of Wiper Attacks We are observing an increase of wiper attacks by the Iran-linked Handala Hack group (aka Void Manticore) through phishing and misuse of Microsoft Intune. The post Insights: Increased Risk of Wiper Attacks appeared first on Unit 42.

Originally from Unit 42: Insights: Increased Risk of Wiper Attacks ( :-{ı▓ #unit42 #threathunting #cyberresearch

@cyberresearch.bsky.social

4 days ago

Auditing the Gatekeepers: Fuzzing "AI Judges" to Bypass Security Controls Unit 42 research reveals AI judges are vulnerable to stealthy prompt injection. Benign formatting symbols can bypass security controls. The post Auditing the Gatekeepers: Fuzzing "AI Judges" to Bypass Security Controls appeared first on Unit 42.

Originally from Unit 42: Auditing the Gatekeepers: Fuzzing "AI Judges" to Bypass Security Controls ( :-{ı▓ #unit42 #threathunting #cyberresearch

@cyberresearch.bsky.social

1 week ago

An Investigation Into Years of Undetected Operations Targeting High-Value Sectors In-depth analysis of threat activity we call CL-UNK-1068. We discuss their toolset, including tunneling, reconnaissance and credential theft. The post An Investigation Into Years of Undetected Operations Targeting High-Value Sectors appeared first on Unit 42.

Originally from Unit 42: An Investigation Into Years of Undetected Operations Targeting High-Value Sectors ( :-{ı▓ #unit42 #threathunting #cyberresearch

@cyberresearch.bsky.social

1 week ago

Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini Panel A high-severity CVE-2026-0628 in Chrome's Gemini allowed local file access and privacy invasion. Google quickly patched the flaw. The post Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini Panel appeared first on Unit 42.

Originally from Unit 42: Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini Panel ( :-{ı▓ #unit42 #threathunting #cyberresearch

@cyberresearch.bsky.social

1 week ago

Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild Uncover real-world indirect prompt injection attacks and learn how adversaries weaponize hidden web content to exploit LLMs for high-impact fraud. The post Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild appeared first on Unit 42.

Originally from Unit 42: Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild ( :-{ı▓ #unit42 #threathunting #cyberresearch

@cyberresearch.bsky.social

1 week ago

Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran Unit 42 details recent Iranian cyberattack activity, sharing direct observations of phishing, hacktivist activity and cybercrime. We include recommendations for defenders. The post Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran appeared first on Unit 42.

Originally from Unit 42: Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran ( :-{ı▓ #unit42 #threathunting #cyberresearch

@cyberresearch.bsky.social

2 weeks ago

Bring the Fight to the Edge: Turning Time Into an Advantage in OT Security Unit 42 research reveals most OT attacks begin in IT. Learn how edge-driven defense stops threats early and turns dwell time into advantage. The post Bring the Fight to the Edge: Turning Time Into an Advantage in OT Security appeared first on Unit 42.

Originally from Unit 42: Bring the Fight to the Edge: Turning Time Into an Advantage in OT Security ( :-{ı▓ #unit42 #threathunting #cyberresearch

@cyberresearch.bsky.social

3 weeks ago

VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731) CVE-2026-1731 is an RCE vulnerability in identity platform BeyondTrust. This flaw allows attackers control of systems without login credentials. The post VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731) appeared first on Unit 42.

Originally from Unit 42: VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731) ( :-{ı▓ #unit42 #threathunting #cyberresearch

@cyberresearch.bsky.social

3 weeks ago

Critical Vulnerabilities in Ivanti EPMM Exploited We discuss widespread exploitation of Ivanti EPMM zero-day vulns CVE-2026-1281 and CVE-2026-1340. Attackers are deploying web shells and backdoors. The post Critical Vulnerabilities in Ivanti EPMM Exploited appeared first on Unit 42.

Originally from Unit 42: Critical Vulnerabilities in Ivanti EPMM Exploited ( :-{ı▓ #unit42 #threathunting #cyberresearch

Ryan Daws

@gadgetry.bsky.social

3 weeks ago

Unit 42: Identity gaps and AI speed increase enterprise risks The fastest quartile of attacks now reach the exfiltration stage in 72 minutes; a sharp contraction from the nearly five hours recorded the previous year.

Unit 42’s report points to AI being a friction reducer for adversaries. It allows actors to operate with machine-like efficiency. #unit42 #paloaltonetworks #cybersecurity #threatintel #ciso #enterprise #infosec #ai #technology

@cyberresearch.bsky.social

1 month ago

Phishing on the Edge of the Web and Mobile Using QR Codes We discuss the extensive use of malicious QR codes using URL shorteners, in-app deep links and direct APK downloads to bypass mobile security. The post Phishing on the Edge of the Web and Mobile Using QR Codes appeared first on Unit 42.

Originally from Unit 42: Phishing on the Edge of the Web and Mobile Using QR Codes ( :-{ı▓ #unit42 #threathunting #cyberresearch

@cyberresearch.bsky.social

1 month ago

Nation-State Actors Exploit Notepad++ Supply Chain Unit 42 reveals new infrastructure associated with the Notepad++ attack. This expands understanding of threat actor operations and malware delivery. The post Nation-State Actors Exploit Notepad++ Supply Chain appeared first on Unit 42.

Originally from Unit 42: Nation-State Actors Exploit Notepad++ Supply Chain ( :-{ı▓ #unit42 #threathunting #cyberresearch

@cyberresearch.bsky.social

1 month ago

A Peek Into Muddled Libra’s Operational Playbook Explore the tools Unit 42 found on a Muddled Libra rogue host. Learn how they target domain controllers and use search engines to aid their attacks. The post A Peek Into Muddled Libra’s Operational Playbook appeared first on Unit 42.

Originally from Unit 42: A Peek Into Muddled Libra’s Operational Playbook ( :-{ı▓ #unit42 #threathunting #cyberresearch

CyberMaterial

@cybermaterial.bsky.social

1 month ago

Asian State Group Breaches 70 Gov Entities
Read More: buff.ly/Qf6nBG6

#CyberEspionage #NationStateThreat #APTCampaign #GovernmentNetworks #CriticalInfrastructure #ThreatIntel #GlobalCyber #Unit42

Persberichten

@persberichten.com

1 month ago

Nieuw onderzoek Palo Alto Networks: wereldwijde cyberspionagecampagne infiltreert kritieke systemen in 37 landen

#Persbericht #Onderzoek #PaloAltoNetworks #Cyberspionage #Unit42

@cyberresearch.bsky.social

1 month ago

Novel Technique to Detect Cloud Threat Actor Operations We introduce a novel method that maps cloud alert trends to MITRE ATT&CK techniques. The patterns created could identify threat actors by behavior. The post Novel Technique to Detect Cloud Threat Actor Operations appeared first on Unit 42.

Originally from Unit 42: Novel Technique to Detect Cloud Threat Actor Operations ( :-{ı▓ #unit42 #threathunting #cyberresearch

@cyberresearch.bsky.social

1 month ago

The Shadow Campaigns: Uncovering Global Espionage In 2025 a threat group compromised government and critical infrastructure in 37 countries, with reconnaissance in 155. The post The Shadow Campaigns: Uncovering Global Espionage appeared first on Unit 42.

Originally from Unit 42: The Shadow Campaigns: Uncovering Global Espionage ( :-{ı▓ #unit42 #threathunting #cyberresearch

@cyberresearch.bsky.social

1 month ago

Why Smart People Fall For Phishing Attacks Why do successful phishing attacks target our psychology rather than just our software? Discover Unit 42’s latest insights on defeating social engineering and securing your digital life. The post Why Smart People Fall For Phishing Attacks appeared first on Unit 42.

Originally from Unit 42: Why Smart People Fall For Phishing Attacks ( :-{ı▓ #unit42 #threathunting #cyberresearch

@cyberresearch.bsky.social

1 month ago

Privileged File System Vulnerability Present in a SCADA System We detail our discovery of CVE-2025-0921. This privileged file system flaw in SCADA system Iconics Suite could lead to a denial-of-service (DoS) attack. The post Privileged File System Vulnerability Present in a SCADA System appeared first on Unit 42.

Originally from Unit 42: Privileged File System Vulnerability Present in a SCADA System ( :-{ı▓ #unit42 #threathunting #cyberresearch

@cyberresearch.bsky.social

1 month ago

Understanding the Russian Cyber Threat to the 2026 Winter Olympics Russia's current isolation from the Olympics may lead to increased cyber threats targeting the 2026 Winter Games. We discuss the potential threat picture. The post Understanding the Russian Cyber Threat to the 2026 Winter Olympics appeared first on Unit 42.

Originally from Unit 42: Understanding the Russian Cyber Threat to the 2026 Winter Olympics ( :-{ı▓ #unit42 #threathunting #cyberresearch

Persberichten

@persberichten.com

1 month ago

Palo Alto Networks waarschuwt: aanvallen beginnen steeds vaker in de browser

#Persbericht #Cybersecurity #Phishing #PaloAltoNetworks #Socialengineering #Unit42 #Kwaadaardigewebsites #Sessionhijacking #BrowserDefensePlaybook #Browserveiligheid #Webbrowser

Persberichten

@persberichten.com

1 month ago

Palo Alto Networks waarschuwt: aanvallen beginnen steeds vaker in de browser

#Persbericht #Cybersecurity #Phishing #PaloAltoNetworks #Socialengineering #Unit42 #Kwaadaardigewebsites #Sessionhijacking #BrowserDefensePlaybook #Browserveiligheid #Webbrowser

@cyberresearch.bsky.social

1 month ago

Happy 9th Anniversary, CTA: A Celebration of Collaboration in Cyber Defense Unit 42 celebrates 9 years of the Cyber Threat Alliance, tracing its journey from a bold idea to a global leader in collaborative cyber defense. The post Happy 9th Anniversary, CTA: A Celebration of Collaboration in Cyber Defense appeared first on Unit 42.

Originally from Unit 42: Happy 9th Anniversary, CTA: A Celebration of Collaboration in Cyber Defense ( :-{ı▓ #unit42 #threathunting #cyberresearch

@cyberresearch.bsky.social

1 month ago

The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time We discuss a novel AI-augmented attack method where malicious webpages use LLM services to generate dynamic code in real-time within a browser. The post The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time appeared first on Unit 42.

Originally from Unit 42: The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time ( :-{ı▓ #unit42 #threathunting #cyberresearch

Persberichten

@persberichten.com

1 month ago

Palo Alto Networks waarschuwt voor nieuwe generatie phishingaanvallen via realtime gegenereerde JavaScript

#Persbericht #Artificialintelligence #Phishing #PaloAltoNetworks #LargeLanguageModels #Realtime #Unit42 #PhisingJavaScript

@cyberresearch.bsky.social

1 month ago

DNS OverDoS: Are Private Endpoints Too Private? We've identified an aspect of Azure’s Private Endpoint architecture that could expose Azure resources to denial of service (DoS) attacks. The post DNS OverDoS: Are Private Endpoints Too Private? appeared first on Unit 42.

Originally from Unit 42: DNS OverDoS: Are Private Endpoints Too Private? ( :-{ı▓ #unit42 #threathunting #cyberresearch

Persberichten

@persberichten.com

1 month ago

Palo Alto Networks waarschuwt voor verhoogde cyberdreiging rond Olympische Winterspelen Milaan-Cortina 2026

#Persbericht #Cyberdreiging #PaloAltoNetworks #Unit42 #OlympischeWinterspelen #OlympischeWinterspelenMilaanCortina2026

John P. Mello Jr.

@jpmjr.bsky.social

1 month ago

Hackers Going for Gold at Winter Olympics The Milano Cortina 2026 Winter Olympics will be a magnet for all types of online threat actors, from nation-state spooks to petty scam art...

From ransomware to fake ticket scams, a new report warns that hackers are ready to exploit the Milano Cortina games. jpmellojr.blogspot.com/2026/01/hack... #PaloAltoNetworks #WinterOlympics #MilanoCortina2026 #Unit42 #scams #cybercrime

@cyberresearch.bsky.social

1 month ago

Anatomy of an Attack: The Payroll Pirates and the Power of Social Engineering Unit 42 breaks down a payroll attack fueled by social engineering. Learn how the breach happened and how to protect your organization from similar threats. The post Anatomy of an Attack: The Payroll Pirates and the Power of Social Engineering appeared first on Unit 42.

Originally from Unit 42: Anatomy of an Attack: The Payroll Pirates and the Power of Social Engineering ( :-{ı▓ #unit42 #threathunting #cyberresearch