Unit 42

@Unit42_Intel

The latest research and news from Unit 42, the Palo Alto Networks (@paloaltontwks) Threat Intelligence and Security Consulting Team covering incident response.

unit42.paloaltonetworks.com

Joined December 2015

Following

70.9K

Followers

Replies Reposts Media

Unit 42
@Unit42_Intel
3h
We documented P2PInfect in 2023 spreading via a Lua sandbox escape. In Mar–Aug 2026, our honeypots saw 692 attacking IPs and 363 C2s push the same worm via Redis misconfig: SLAVEOF to a rogue master, and RDB writes planting a crontab entry and an SSH key: bit.ly/3VDGdvC
Unit 42
@Unit42_Intel
22h
A sustained ClickFix campaign has compromised 350+ websites on a leading CMS platform since August. The attack abuses a free CDN, hosting and rotating malicious payloads across public repos. Details at bit.ly/4rCmBEt
2
Unit 42
@Unit42_Intel
Sep 16
Attackers with root access on a compromised Kubernetes node can manipulate control group metadata to bypass SPIFFE and SPIRE open standard workload identity controls. This prompts systems to issue credentials for co-located app: bit.ly/4iVSIMO
4
Unit 42
@Unit42_Intel
Sep 15
NeuralOverride is a Cyrillic Python RAT using Telegram for C2 and integrating the #OpenRouter LLM for autonomous attack planning. It includes #SCADA tasking stubs referencing a missing scada_commander.py module. The 5-build family evolved over one month: bit.ly/4j5xRXs
1
Unit 42
@Unit42_Intel
Sep 15
ZionSiphon v4 is a #Rust rewrite of the OT (ICS) sabotage tool targeting Israeli water and #desalination systems. Adds USB propagation and Modbus write attempts. Details at bit.ly/4hucnlP