Palo Alto Networks

threat research

2023 Unit 42 Attack Surface Threat Report Highlights the Need for ASM

Palo Alto Networks Unit 42 illuminates some of the riskiest security observations around attack surface management (ASM) with the 2023 Unit 42 Attack Surface Threat Report. The report contrasts the dynamic nature of cloud environments with the speed at which threat actors are exploiting new vulnerabilities. It found that cybercr...

Points of View

Products and Services

Unit 42

Sep 14, 2023

By Matt Kraning

Palo Alto Networks

Products and Services

Partners

Events, Must-Read Articles, News and Events

Cybersecurity Insights: Upcoming Events with the Threat Research Team

Our Threat Research team at Palo Alto Networks is actively sharing their intelligence and findings on the global stage in some upcoming events:

Sep 13, 2023

By Dena De Angelo

CIEM

Mitigate Cloud Breaches With a Holistic Approach to Cloud Identity and Acce...

There’s no hiding from it. Cloud data breaches are on the rise. Threat actors are more prevalent and sophisticated. And the stakes for organizations across all industries remain hi...

Jul 03, 2023

By John Chavanne

Cloud Infrastructure Entitlement Management, Cloud Native Application Platform, Cloud Workload Protection Platform, Points of View

Containers, Assemble: What Cloud Threat Actors Don’t Want You to Know

It’s like the snap of a familiar set of fingers wearing the gauntlet embedded with infinit...

Jun 06, 2022

By Aimee Savran

Cloud Computing, Cloud Workload Protection Platform, Cybersecurity

WAAS-Up with Cryptojacking Microservice-Based Web Apps?

This is an account of a real attack that took place against a web application pod running on a self-managed Kubernetes cluster. The adversaries leveraged a vulnerability in the app...

Jun 03, 2021

By Scott McAndrew

News and Events, Product Features

Cortex XDR Blocks Undiscovered UAC Bypasses

Cortex XDR researchers recently found new UAC (User Account Control) bypasses on a fully patched Windows 10. While the method used is not new, the abused binaries that can be used with that method were previous...

Oct 15, 2020

By Or Chechik

Secure the Future

Announcing Cortex XDR Managed Threat Hunting – Community Edition and New XD...

We are proud to announce the Community Access edition of Cortex XDR Managed Threat Hunting, a powerful threat hunting service exclusively for our Cortex XDR customers. For a limite...

Feb 06, 2020

By Mitchell Bezzina

Secure the Enterprise

Unit 42 Named Top Zero-Day Vulnerability Contributor by Microsoft

Palo Alto Networks is proud that Microsoft has recognized our Unit 42 global threat intelligence team with multiple awards for its contributions to vulnerability research, includin...

Aug 16, 2019

By John Harrison

Threat Research

OilRig Data Analysis Shows Breadth of Hacking Campaign

Palo Alto Networks Unit 42 threat research team has determined that the OilRig hacking group’s activities are more widespread than previously understood, compromising at least 97 organizations in 27 countries,...

Apr 30, 2019

By Unit 42

Unit 42

EMEA Bi-Monthly Threat Reports: Turkey, Saudi Arabia & United Arab Emi...

As part of a new series of regular threat report updates to the public covering different sets of countries from around the EMEA (Europe Middle East and Africa) region, this blog c...

Jul 10, 2017

By Alex Hinchliffe

Unit 42

EMEA Bi-Monthly Threat Reports: United Kingdom, Germany & France

In December 2016 I posted the first of a two-part blog series, the second of which posted in April this year, to start a series of regular threat report updates to the public cover...

Jun 09, 2017

By Alex Hinchliffe

Unit 42

A New Trend in Android Adware: Abusing Android Plugin Frameworks

It is common for legitimate mobile apps to embed advertising SDKs or promote other apps. Showing ads or promoting other apps can generate revenue for legitimate app developers. How...

Mar 22, 2017

By Cong Zheng, Wenjun Hu and Zhi Xu

Unit 42

Targeted Ransomware Attacks Middle Eastern Government Organizations for Pol...

Recently, Unit 42 has observed attacks against multiple Middle Eastern government organizations using a previously unseen ransomware family. Based on embedded strings within the ma...

Mar 08, 2017

By Robert Falcone and Josh Grunzweig

Unit 42

Google Play Apps Infected with Malicious IFrames

Recently, we have discovered 132 Android apps on Google Play infected with tiny hidden IFrames that link to malicious domains in their local HTML pages, with the most popular one having more than 10,000 install...

Mar 01, 2017

By Xiao Zhang, Wenjun Hu and Shawn Jin

Unit 42

The Gamaredon Group Toolset Evolution

Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013.

Feb 27, 2017

By Anthony Kasza and Dominik Reichel

Unit 42

Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments

Palo Alto Networks Traps Advanced Endpoint Protection recently prevented recent attacks that we believe are part of a campaign linked to DustySky. DustySky is a campaign which othe...

Jan 30, 2017

By Mashav Sapir, Tomer Bar, Netanel Rimer, Taras Malivanchuk, Yaron Samuel and Simon Conant

Threat Brief, Unit 42

Threat Brief: Shamoon 2 Wave 3 Attacks

As part of Palo Alto Networks Unit 42’s ongoing monitoring of the Shamoon 2 situation, we have updated information since our last posting Threat Brief: Second Wave of Shamoon 2 Attacks Reveal Possible New Tactic.

Jan 30, 2017

By Christopher Budd

Unit 42

Farming Malicious Documents to Unravel Ransomware

While analyzing a recent malicious Microsoft Word document, it downloaded a ransomware variant, “SAGE 2.0” (Sage Locker), which is a spin-off from CryLocker. This ransomware has been slowly making the rounds la...

Jan 27, 2017

By Jeff White

Unit 42

Exploring the Cybercrime Underground: Part 3 – Into the RAT Nest

In this third part of Unit 42’s Cybercrime Underground blog series, we’re taking a slightly different approach. In this blog we begin with data from a real attack in the wild, and...

Jan 26, 2017

By Simon Conant

Unit 42

2016 Updates to Shifu Banking Trojan

Shifu is a Banking Trojan first discovered in 2015. Shifu is based on the Shiz source code which incorporated techniques used by Zeus. Attackers use Shifu to steal credentials for online banking websites around the world, starting in Russia but later including the UK, I...

Jan 06, 2017

By Dominik Reichel

Unit 42

Review of Regional Malware Trends in EMEA: Part 1

As we head towards the end of the year it’s common to reflect on the year almost behind us and to predict what the new year approaching will bring in terms of security challenges. This blog is part of a series...

Dec 23, 2016

By Alex Hinchliffe

Load more blogs