Unit 42

@Unit42_Intel

The latest research and news from Unit 42, the Palo Alto Networks (@paloaltontwks) Threat Intelligence and Security Consulting Team covering incident response.

unit42.paloaltonetworks.com

Joined December 2015

Unit 42
@Unit42_Intel
Aug 25
Kimwolf v7 upgrades its DDoS capabilities on Android TV boxes by adding HTTP/2 floods with browser fingerprint spoofing. This technique makes malicious traffic resemble legitimate browser requests: bit.ly/3SvcnZ9
Unit 42
@Unit42_Intel
Aug 24
Identity phishing via collaboration tools exploits trust in internal channels. Attackers send direct messages linking to proxy servers to harvest credentials and MFA tokens in real time. Read our research to protect your workforce: bit.ly/4gKbTHW
Unit 42
@Unit42_Intel
Aug 19
Aeternum botnet leverages smart contracts on the Polygon blockchain to store and retrieve C2 instructions. Querying public RPC endpoints allows infected endpoints to execute immutable commands and evade takedowns. Read our full analysis: bit.ly/45pDx6D
Unit 42
@Unit42_Intel
Aug 17
Threat actor theHatman is selling corporate data allegedly exfiltrated from Microsoft Entra tenants. Unit 42 hasn't verified the specific intrusion vector, but we advise using mitigations appropriate to credential attacks, as outlined here: bit.ly/3RWfERf
Unit 42
@Unit42_Intel
Aug 14
65% of initial access now stems from identity abuse rather than software vulnerabilities, and attacks into enterprise environments often start with a valid login. How can SOC leaders correlate telemetry to detect compromised credentials early? Learn now: bit.ly/4clkZs2