Product

DNS Security

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 17, 2026 · last 29d ago

Timeline2 articles

Threat Assessment: Ryuk Ransomware

Unit 42 assesses Ryuk ransomware amid a CISA/FBI/HHS alert on threats to U.S. healthcare, including the UHS attack that disrupted hospital operations.

A joint CISA, FBI, and HHS alert on October 28, 2020 warned of an imminent threat to U.S. healthcare from operators deploying Trickbot and Ryuk ransomware. Universal Health Services reported a Ryuk attack that disrupted all U.S. UHS sites for weeks, with similar incidents at hospitals in Oregon and New York. Ryuk typically arrives after Trickbot or BazaLoader infections delivered via malicious email, and operators enumerate networks with PowerShell and WMI before encryption. The Trickbot Anchor_DNS module performs DNS tunneling for C2, using connectivity checks to benign domains like ipinfo.io and checkip.amazonaws.com.

Palo Alto Unit 42Aug 17, 13:18 UTC · 29d agoRansomware in the wild

Recent Trends in Internet Threats: Common Industries Impersonated in Phishing Attacks, Web Skimmer Analysis and More

Unit 42 analyzed 67 million malicious URLs and domains in H2 2022, a 52% increase, highlighting phishing impersonation and web skimmer trends.

Unit 42 observed more than 67 million unique malicious URLs, domains and IPs between July and December 2022, a 52% increase over the first half of the year. Malicious JavaScript detections grew 99.3%, with over 4 million malicious JS samples hosted on 4.8 million URLs. Over 85% of hosting infrastructure was concentrated in eight countries, led by the United States, Brazil and China. The report also analyzes industries spoofed in phishing pages and includes a web skimmer case study on a Tranco top 1 million website.

Palo Alto Unit 42Aug 17, 13:04 UTC · 29d agoResearch

Appears with

vendor Palo Alto Networks 2 malware Ryuk 1 malware Trickbot 1 organization CISA 1 organization FBI 1 organization HHS 1 organization Palo Alto Networks 1 organization Unit 42 1 product Advanced URL Filtering 1 product Cortex XDR 1 product WildFire 1 vendor Unit 42 1 malware BazaLoader 1 victim Universal Health Services 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.