Almost Half of Malware Samples Communicate Direct to IP
Unit 42 analysis of 4 million malware reports finds 45% of C2-active samples connect directly to hard-coded IPs, bypassing DNS defenses.
55
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenAug 17, 2026
- Last mentionedAug 17, 2026
Timeline
5 articles · newest firstAttack Paths Into VMs in the Cloud
Unit 42 maps attack paths into AWS, Azure, and GCP VMs through intended features like startup scripts and SSH key pushes.
42
AI Tool Identifies BOLA Vulnerabilities in Easy!Appointments
Unit 42's AI-powered tool found 15 BOLA vulnerabilities in Easy!Appointments, rated up to CVSS 9.9, letting low-privileged users escalate privileges; fixed in 1.5.0.
48
Identifying a BOLA Vulnerability in Harbor, a Cloud
Unit 42 found a BOLA flaw, CVE-2024-22278 (CVSS 6.4), letting Maintainers improperly alter Harbor project metadata; fixed in versions 2.9.5, 2.10.3, and 2.11.0.
40
Harnessing LLMs for Automating BOLA Detection
Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.
45
Related CVEs
by mentions- CVE-2023-3288<1%8.8A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system
- CVE-2023-3287<1%8.8A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system
- CVE-2023-38051<1%8.1A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary)
- CVE-2023-38054<1%8.1A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer)
- CVE-2023-38050<1%8.1A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin)
- CVE-2023-3285<1%7.7A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin)
- CVE-2024-1313<1%6.5It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to…
- CVE-2023-3289<1%6.5A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin)
- CVE-2023-3290<1%5.0A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system
- CVE-2024-22278<1%4.3Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations
Appears with
- Unit 42organization · 5
- Palo Alto Networksorganization · 5
- Palo Alto Networksvendor · 5
- Grafanaproduct · 2
- Harborproduct · 2
- Easy!Appointmentsproduct · 2
- Advanced WildFireproduct · 1
- Easy!Appointmentsvendor · 1
- Phorpiexmalware · 1
- Mozimalware · 1
- Google Cloud Platformorganization · 1
- BOLABusterai model · 1
- Amazon Web Servicesvendor · 1
- Google Cloud Platformvendor · 1
- Microsoft Azurevendor · 1
- Amazon Web Servicesorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.