Vendor

Palo Alto Networks Unit 42

0 mentions in 7 days · 3 in 30 days · 5 total · first seen Aug 11, 2026 · last 13d ago

Timeline5 articles

ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories

Microsoft warns of Teams IT-impersonation intrusions deploying Node.js implants; Spring Ring vishing hit 150+ employees across 10 companies; The Gentlemen ransomware claims 683 victims.

Microsoft warned of a human-operated campaign abusing Teams external collaboration to impersonate IT help desk staff, deploy malicious MSI packages staging Node.js runtimes and obfuscated JavaScript implants, then pivot to domain controllers over WinRM. Unit 42 documented the Spring Ring vishing operation targeting over 150 employees across at least 10 companies using 26 attacker identities, including an NTLM relay variant against domain controllers. Sophos reported The Gentlemen ransomware (Gold Sherwood) reached 683 total victims by end of July 2026, adding 169 in July, with a playbook using BYOVD-based EDR killers and backup tampering. Group-IB found the Outsider phishing-as-a-service platform created 700+ new phishing pages within a month despite law enforcement takedowns.

The Hacker NewsSep 3, 18:02 UTC · 13d agoThreat actor in the wild1

Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages

Check Point links Gambling Goblin, a Chinese-speaking cluster, to malicious Apache modules hijacking Brazilian government servers to promote betting sites.

Check Point Research tracks Gambling Goblin, a Chinese-speaking cluster, installing malicious Apache reverse-proxy modules on compromised Brazilian government and education web servers since mid-2025. The modules divert visitors to gambling and fake app-store pages while stripping the site's security headers, likely for large-scale SEO manipulation. The group's Linux arsenal includes DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcing tools, and it is tied to Trend Micro's Earth Berberoka. Related SEO-fraud campaigns on .gov.br domains were documented by ESET (GhostRedirector), Palo Alto Networks Unit 42, and Hunt.io.

The Hacker NewsSep 2, 13:44 UTC · 14d agoThreat actor in the wild

ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories

Weekly ThreatsDay bulletin details a ShinyHunters-style social engineering hit on ReliaQuest, the 296,000-device Dysphoria IoT botnet, and several new malware families.

ReliaQuest confirmed a social engineering attack on August 22, 2026, in which an attacker used a fake SSO page and MFA push approval to gain brief view-only access to an identity dashboard, with tactics matching ShinyHunters, which has since listed the firm on its leak portal. The Shadowserver Foundation reported the Dysphoria botnet has compromised nearly 296,000 IoT devices for DDoS attacks and recently added residential proxy capability. Cisco Talos documented JWR, an operator-driven phishing-as-a-service framework linked to The Outsider that harvests credentials, identity documents, and 2FA codes over an encrypted WebSocket. New malware coverage includes the Octagon Android fraud bot ($1,400/month), the C2Looper Rust backdoor delivered via ClickFix, and the Aeternum loader that moved C2 to the Polygon blockchain.

The Hacker NewsSep 1, 17:35 UTC · 15d agoMalware in the wild

Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing

New Kimwolf v7 Android botnet adds HTTP/2 DDoS floods with Chrome fingerprints and takedown-resistant ENS/Tor C2.

Palo Alto Networks Unit 42 discovered Kimwolf v7, an evolution of the Kimwolf/AISURU Android and IoT botnet first tracked in February 2026. The new version performs HTTP/2 floods mimicking Chrome browser fingerprints and uses Ethereum Name Service, Tor hidden services, and a local proxy for resilient C2. The botnet targets Android TV boxes via ADB on port 5555 and offloads propagation to an external loader.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026Malware in the wildCVE-2024-36401

Nearly 800 Malicious npm Packages Deliver Cross

Nearly 800 typo-squatted npm packages deliver WEL1DROPPER, a cross-platform downloader installing RAT and infostealer payloads on Windows, macOS, Linux.

Researchers found roughly 800 npm packages with AI-generated typo-squat names that trigger a WEL1DROPPER downloader when loaded via require() rather than install hooks. The downloader fetches payloads from Cloudflare Workers hosts, falling back to DNS TXT records from wel1.ru, then achieves persistence, sandbox checks, ETW/AMSI patching and Sliver C2 deployment on Linux. Domains like tcsbank.ru suggest targeting of Russian financial institutions; Sonatype tracks the campaign as Flooding Dropper, a possible evolution of the Moika dependency-confusion campaign. Unit 42 separately documented npm/PyPI crypto stealers and malicious Chrome extensions that turn browsers into residential proxy crawlers.

The Hacker NewsAug 11, 14:37 UTC · Aug 11, 2026Malware in the wild

Related CVEsby mentions

CVE-2024-364019.8100%
Unauthenticated RCE in OSGeo GeoServer via GeoTools XPath Injection
OSGeo GeoServer ships the GeoTools library, which evaluates feature property names directly as XPath expressions without proper neutralization (CWE-95), so attacker-supplied input is executed as code rather than treated as data. A remote, unauthenticated attacker triggers the flaw by sending specially crafted requests to a GeoServer service, causing the injected expression to be evaluated in the server's context. Successful exploitation results in remote code execution on the host running GeoServer, giving the attacker control over the mapping server and any data or credentials it can reach. Any organization running GeoServer is affected, and the underlying GeoTools flaw also extends to dependent applications such as GeoNetwork, which shipped its own fix for an unauthenticated RCE chain affecting government geoportal backends. The flaw is being actively exploited: it was added to CISA KEV on 2024-07-15, and EPSS assigns a 99.8% probability of exploitation within 30 days.
· OSGeo GeoServer Multiple releases prior to the vendor-patched builds (fixed in the 2.23.x, 2.24.x and 2.25.x maintenance lines; exact fixed releases per the OSGeo advisory: 2.2 · OSGeo GeoNetwork (bundles the vulnerable GeoTools library) KEV PoC ×3large

Appears with

threat actor ChenLun 1 threat actor Earth Berberoka 1 threat actor Gambling Goblin 1 threat actor GhostRedirector 1 threat actor Gold Sherwood 1 threat actor Kimwolf 1 threat actor ShinyHunters 1 threat actor Spring Ring 1 threat actor The Gentlemen 1 malware 3snake 1 malware Aeternum 1 malware AISURU 1 malware AlphaAgent 1 malware BlueKit 1 malware C2Looper 1 threat actor AndroidKitKat 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.