CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia
We identified a cluster of activity that we track as CL-STA-0048. This cluster targeted high-value targets in South Asia, including a telecommunications organization.
Prisma Cloud Security Research
Cybercrime, Malware, Threat Actor Groups, Threat Research, Active Directory, AdFind, ALPHV, Ambitious Scorpius, Blackcat, BloodHound
LDAP Enumeration: Unveiling the Double-Edged Sword of Active Directory
Unit 42 researchers have discovered new security vulnerabilities in the Azure Data Factory...
Cloud Cybersecurity Research, Threat Research, Apache Airflow, Containers, Kubernetes, Microsoft Azure, Microsoft Azure Data Factory
Dirty DAG: New Vulnerabilities in Azure Data Factory’s Apache Airflow Integ...
Unit 42 spent six months researching the China-based cybercrime group Rocke, which is the...
Cybercrime, High Profile Threats, Ransomware, Threat Actor Groups, BlackSuit ransomware, construction, Education, Extortion, Ignoble Scorpius, leaksite
Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware
Unit 42 researchers have observed an increase in BlackSuit r...
Business Email Compromise, Threat Actor Groups, Threat Research, BeaverTail, CL-STA-0237, Contagious Interview, DPRK, Fake IT Worker, InvisibleFerret, Lazarus
Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phish...
Unit 42 researchers identified a North Korean IT worker acti...
Cloud Cybersecurity Research, Threat Research, data exfiltration, Google Cloud, Kubernetes, LLM, poisoned model, privilege escalation, Vertex AI
ModeLeak: Privilege Escalation to LLM Model Exfiltration in Vertex AI
In the race to gain a competitive edge, organizations are increasingly training artificial...
Cybercrime, Threat Actor Groups, Threat Research, C++, CL-CRI-0941, CVE-2017-11317, CVE-2019-18935, GodPotato, Python, Remote Code Execution
Silent Skimmer Gets Loud (Again)
This article introduces a simple and straightforward technique for jailbreaking that we call Deceptive Delight. Deceptive Delight is a multi-turn tech...
Nation-State Cyberattacks, Ransomware, Threat Actor Groups, Threat Research, Cobalt Strike, DPRK, DTrack, Fiddling Scorpius, Infostealer, Jumpy Pisces
Jumpy Pisces Engages in Play Ransomware
Unit 42 has identified Jumpy Pisces, a North Korean state-sponsored threat group associated with the Reconnaissance Gene...
Malware, Threat Actor Groups, Threat Research, Advanced Persistent Threat, BeaverTail, CL-STA-240, Contagious Interview, DPRK, InvisibleFerret, North Korea
Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to ...
Unit 42 has tracked activity from threat actors associated w...
Unraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpy
Unit 42 researchers discovered two malware samples used by the Sparkling Pisces (aka Kimsuky) threat group. This includes an undocumented keylogger, c...
Malware, Threat Actor Groups, AppleJeus, Citrine Sleet, Cryptocurrency, Gleaming Pisces, Linux, macOS, North Korea, PondRAT
Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux an...
Unit 42 researchers have been tracking the activity of an ongoing poisoned Python packages...
Cybercrime, High Profile Threats, Ransomware, Threat Actor Groups, Threat Research, ALPHV, Ambitious Scorpius, Bashful Scorpius, BlackCat ransomware, Cicada3301
Threat Assessment: Repellent Scorpius, Distributors of Cicada3301 Ransomwar...
Repellent Scorpius is a new ransomware-as-a-service (RaaS) g...
Cybercrime, High Profile Threats, Malware, Nation-State Cyberattacks, Threat Actor Groups, Advanced Persistent Threat, Alluring Pisces, Andariel, Bluenoroff, Citrine Sleet
Threat Assessment: North Korean Threat Groups
Lazarus has been used in public reporting as an umbrella term for threat actors from the D...
Malware, Threat Actor Groups, Advanced Persistent Threat, China, DLL Sideloading, Dropbox, Espionage, Government, Microsoft Visual Studio, Mimikatz
Chinese APT Abuses VSCode to Target Government in Asia
In the summer of 2018, Unit 42 released reporting regarding activity in the Middle East surrounding a cluster of activit...
Cloud Cybersecurity Research, Ransomware, Threat Actor Groups, AWS, AWS credential stealing, Bling Libra, Extortion, MITRE, S3, ShinyHunters
Bling Libra’s Tactical Evolution: The Threat Actor Group Behind ShinyHunter...
In an incident response engagement handled by Unit 42, the threat actor group Bling Libra...
Cloud Cybersecurity Research, Threat Research, AWS, credential theft, data exfiltration, ENV files, environment variable files, Exploit Kits, exposed environment files, Extortion
Leaked Environment Variables Allow Large-Scale Extortion Operation in Cloud...
Unit 42 researchers found an extortion campaign's cloud oper...
ArtiPACKED: Hacking Giants Through a Race Condition in GitHub Actions Artif...
In part 1 of this 2-part blog series, we discussed why the Havex Trojan is a significant and concerning industry milesto...