ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Vendor

Palo Alto Networks

19 mentions in 7 days · 148 in 30 days · 153 total · first seen · last

Search everything

Timeline

‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

White House launches Watershed 250, a six-month Texas pilot using volunteer vendor cyber and AI tools to harden water utility defenses.

The Office of the National Cyber Director and Texas Cyber Command will oversee the six-month Project Watershed 250 pilot to improve water sector cybersecurity through industry-donated red teaming, system hardening and AI tooling. Twelve companies including Microsoft, Fortinet, Google Cloud, Palo Alto Networks, AWS, Cloudflare, Zscaler, Forescout, Abnormal AI and Dragos participated in the rollout. Officials cited recent attacks including an Iranian-backed campaign against 30 water systems in 12 states and a 2024 incident in Muleshoe, Texas. Some water-security professionals criticized the program as lacking dedicated funding.

CyberScoop · 15d agoPolicy & legal1

Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams

Unit 42 details the Spring Ring voice phishing campaign abusing Microsoft Teams to deploy malware and target enterprise domain controllers.

Palo Alto Networks Unit 42 analyzed the Spring Ring campaign, which abuses Microsoft Teams and voice phishing (vishing) to compromise enterprise users. Attackers use Teams calls to social-engineer victims, then deploy malware and advance toward enterprise domain controllers. The report documents the campaign's tactics and provides detection guidance for defenders.

Palo Alto Unit 42 · 15d agoPhishing & fraud in the wild

Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety

Unit 42 research shows LLM safety refusals concentrate in a thin neural layer, motivating external, multi-layered AI security controls.

Palo Alto Networks Unit 42 introduces Perturbation Probing, a diagnostic technique for measuring the fragility of LLM safety mechanisms. The research finds that safety refusal behavior is localized within a thin neural layer, implying small perturbations can undermine built-in refusals. The authors argue this motivates external, multi-layered security defenses on top of model-internal safety training.

Palo Alto Unit 42 · 18d agoAI safety & security

Prisma Airs

Palo Alto Networks Unit 42 page for Prisma AIRS, the vendor's AI Runtime Security product line for protecting AI applications.

The item is a Unit 42 product category page for Prisma AIRS with no article text available. Prisma AIRS is Palo Alto Networks' AI Runtime Security offering aimed at securing AI applications and agents. No incident, research findings, or release details can be confirmed from the available title alone.

Palo Alto Unit 42 · 18d agoAI tools & infra

Ai Security Assessment

Unit 42's AI security assessment page describes Palo Alto Networks' offering for evaluating AI system security; no article text is available.

The item is a Palo Alto Networks Unit 42 product category page for 'AI security assessment' with no article body. It likely indexes Unit 42 content or services related to assessing the security of AI systems. No concrete incidents, vulnerabilities, or research findings are described.

Palo Alto Unit 42 · 18d agoAI safety & security

100-plus companies call for ‘global surge’ in AI

OpenAI, Anthropic, Google, Microsoft, AWS and 100+ organizations sign open letter urging a 'global surge' in AI-powered cyber defenses.

More than 100 companies including OpenAI, Anthropic, Google, Microsoft, AWS, Capital One, Mastercard, CrowdStrike, Palo Alto Networks and Proofpoint signed an open letter published Thursday calling for accelerated cybersecurity defenses as AI capabilities advance. The letter argues a shrinking 'defenders' window' exists to fix accumulated weaknesses such as excessive permissions, misconfigurations and unpatched legacy systems before AI-enabled attacks grow more widespread. It asks governments to coordinate cross-border defense and fund protection of critical infrastructure, and asks frontier AI labs to provide model access, funding and support. It references a June US executive order creating the Gold Eagle AI threat-sharing clearinghouse.

CyberScoop · 18d agoIndustry

Unit 42 warns AI has shifted balance of power from defenders to attackers

Unit 42 says agentic AI has shifted attacker advantage, investigating an incident where one attacker exploited 50 enterprise applications in under 10 hours.

Palo Alto Networks Unit 42 leaders said early waves of agentic AI-enabled attacks are breaking in the wild and that frontier model capabilities have shifted the balance of power from defenders to attackers. The team is actively investigating an attack on a customer where an attacker used an agentic framework to exploit 50 applications and other weaknesses across the enterprise in less than 10 hours, work they estimate would have taken at least 10 days pre-AI. Unit 42 says AI already touches the entire attack chain, including malware development, social engineering, and ransomware negotiations. The warning follows April's Project Glasswing initiative formed with Anthropic around its Mythos model.

CyberScoop · 19d agoAI safety & security in the wild

OT Threat Research

Palo Alto Networks Unit 42 launched an OT Threat Research Lab to study how cyber threats disrupt industrial and critical-infrastructure operations.

Unit 42 announced a dedicated OT Threat Research Lab for testing emerging technologies, evaluating AI-OT scenarios, and examining how threats move across connected operational systems. The lab's findings are intended to inform vulnerability analysis, detection guidance, and risk prioritization for operational technology environments.

Palo Alto Unit 42 · 19d agoIndustry

Threat Bulletin

Palo Alto Networks Unit 42 published a threat bulletin, but no article body was available for detailed analysis.

The feed item contained only the title 'threat bulletin' with no article text. No specific incidents, actors, or vulnerabilities could be extracted from the available content.

Palo Alto Unit 42 · 19d agoAdvisory

Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter

Joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs shows nation-state and criminal groups independently converge on the same edge infrastructure.

Tenable and SentinelOne jointly analyzed 93 CVE-actor attribution pairs covering exploitation of perimeter devices. The data shows state-sponsored and financially motivated actors independently target the same edge products from Ivanti, Fortinet, and Palo Alto Networks. The findings challenge the narrative that edge exploitation is exclusively a China-nexus nation-state problem, showing a broader shared attack surface.

Tenable Blog · 20d agoThreat actor in the wild

Code review used to be the only way to catch these bugs

Palo Alto Networks' Unit 42 says its NOVA system found 14,090 vulnerabilities in 3,915 open-source projects, mostly non-crashing bugs like access control flaws.

Unit 42's NOVA system analyzed 3,915 open-source projects over two months and reported 14,090 validated vulnerabilities, only 85 of which matched previously documented findings. 92% of findings fell outside fuzzing-friendly categories, clustering instead in access control, path traversal, injection, prototype pollution, and SSRF; language ecosystems showed distinct weakness profiles. Of 5,421 supply-chain findings, 1,280 were flaws in dependencies while 4,141 were downstream exposures, 2,776 validated with working proof-of-concepts. Unit 42 warned that faster discovery combined with an average 55-day patch deployment window has collapsed the patch-to-exploit gap.

Help Net Security · 21d agoResearch

The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution

Unit 42's August 2026 report tracks the rise of AI-enabled malware, from brand abuse to agentic execution, and how behavioral detection stops AI-authored code.

Palo Alto Networks Unit 42 released its August 2026 assessment of AI-enabled malware, covering attacker use cases from brand abuse to agentic execution. The report details how existing behavioral detection and endpoint analytics can stop AI-authored code before execution.

Palo Alto Unit 42 · 21d agoResearch

Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain

Unit 42 warns attackers increasingly target CI/CD pipelines and developer tools rather than application code, urging full SDLC supply chain visibility.

Palo Alto Networks Unit 42 research argues attackers are shifting focus from application code to overlooked corners of the software development lifecycle supply chain, including CI/CD pipelines and developer tooling. The write-up calls for total SDLC visibility and strict security controls to defend these developer-facing attack surfaces.

Palo Alto Unit 42 · 24d agoResearch in the wild

Cortex Cloud Archives

Palo Alto Networks publishes a product category page for Cortex Cloud, an AI and automation platform for cloud and SOC workflows.

This item is a product category archive page for Palo Alto Networks' Cortex Cloud, describing it as an AI and automation-driven platform spanning code to cloud to SOC. The page contains no new research, incident, or product release details beyond marketing language about prioritizing risks and accelerating remediation.

Palo Alto Unit 42 · 26d agoIndustry

Tufin expands Unified Control Plane with AI intelligence and multi-vendor automation

Tufin's TOS 5.3 adds AI-powered Segmentation Intelligence and multi-vendor automation for AWS, Palo Alto, VMware NSX-T, and Cisco Meraki to its Unified Control Plane.

Tufin TOS 5.3 extends the Unified Control Plane with enhanced AWS firewall, Palo Alto Strata Cloud Manager, VMware NSX-T, and Cisco Meraki support for automated policy and access-request provisioning. The new AI-powered Segmentation Intelligence solution continuously analyzes segmentation policies to identify gaps, drift, and recommended fixes. Tufin cites research that 49% of organizations manage more than 20 security tools across hybrid environments.

Help Net Security · 26d agoTools

Unit 42 - Latest Cyber Security Research

Unit 42 briefing warns frontier AI models compress exploit development timelines and highlights 2026 incident response report findings on AI-accelerated attacks.

Palo Alto Networks Unit 42 published a threat briefing and Global Incident Response Report arguing that frontier AI models enable threat actors to move from initial access to exfiltration in minutes rather than months. The report found attacks are 4x faster, 65% of initial access is driven by identity-based techniques, and 87% of attacks unfold across multiple surfaces. The briefing offers CISO guidance on prioritizing defenses against AI-accelerated, automated attacks.

Palo Alto Unit 42 · 27d agoAI safety & security

Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices

Unit 42 found a Muhstik botnet variant brute-forcing Tomato router web authentication to harvest IoT devices for crypto mining and DDoS attacks.

Palo Alto Networks Unit 42 researchers in December 2019 identified a new Muhstik botnet variant scanning Tomato routers on TCP 8080 and brute-forcing default admin credentials, targeting roughly 4,600 exposed devices found via Shodan. The variant also scans WordPress and Webuzo installations and exploits the Oracle WebLogic deserialization flaw CVE-2019-2725 for unauthenticated remote code execution. Muhstik, active since March 2018, self-propagates like a worm and typically monetizes infections through cryptocurrency mining and DDoS attacks controlled via an IRC C2 channel.

Palo Alto Unit 42 · 27d agoMalware in the wildCVE-2019-2725

Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self

Unit 42 uncovered Eleethub, a Perl-based Bitcoin mining botnet using a crafted rootkit and libprocesshider to evade detection, still under development with few infections.

Unit 42 discovered an under-development Perl Shellbot campaign that mines Bitcoin using xmrig and emech while evading detection via a rootkit that replaces the ps tool and the LD_PRELOAD-based libprocesshider.so library. Infected devices download a malicious shell script, connect to IRC-based C2 at eleethub.com and the UnderNet network, and can receive commands for UDP/TCP floods, port scans, and HTTP attacks. The botnet can affect Unix systems and Windows 10 hosts running a Linux subsystem, and its operators use the 'Los Zetas' branding, though they are unlikely to be the Mexican drug cartel. Researchers found only a few compromised 'zombies' before the campaign expanded.

Palo Alto Unit 42 · 27d agoMalware in the wild

Advanced Threat Prevention Archives

Palo Alto Networks Unit 42 archive listing page for the Advanced Threat Prevention product category, with no standalone news item.

This item is a Palo Alto Networks Unit 42 product category archive page for Advanced Threat Prevention, describing the product's positioning against commodity and targeted network threats. It contains no dated incident, vulnerability disclosure, or research finding. No specific events, CVEs, or threat actors are mentioned.

Palo Alto Unit 42 · 27d agoOther

Next

Palo Alto Networks product-category page describing Next-Generation Firewall threat detection, including encrypted traffic; no standalone article.

The page is a product category listing for Palo Alto Networks Next-Generation Firewalls, stating the products detect known and unknown threats, including in encrypted traffic, using intelligence from many thousands of customer deployments. It contains no research findings, vulnerabilities, or incident details relevant to defenders.

Palo Alto Unit 42 · 27d agoIndustry

Iot Security

Vendor product-category page for Palo Alto Unit 42 IoT security content, published with no article text available.

The URL points to Palo Alto Unit 42's 'IoT Security' product category listing rather than a research article. No article body was available, so no incident, vulnerability, or research findings can be extracted from this item.

Palo Alto Unit 42 · 27d agoIndustry

Prisma Cloud Archives

Unit 42 archive page for Prisma Cloud product-category articles; contains no new research or announcements.

This Unit 42 archive page lists product-category posts about Prisma Cloud, Palo Alto Networks' cloud security platform for public clouds, SaaS applications and remote users. It contains no new research, incidents, or product announcements.

Palo Alto Unit 42 · 27d agoIndustry

FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications

Unit 42 dissects FrostyGoop OT malware, which sent Modbus TCP commands to disrupt heating for 600+ apartment buildings in Ukraine.

Palo Alto Unit 42 analyzed new FrostyGoop/BUSTLEBERM samples, the ninth known ICS-centric malware, first used against a Ukrainian municipal energy company by sending Modbus TCP commands to ENCO control devices. The attack caused a two-day heating outage affecting over 600 apartment buildings during sub-zero temperatures. The Go-compiled malware accepts Modbus register operations and timing parameters via command-line arguments or a JSON configuration file, uses an obscure open-source Modbus library, and checks the Windows BeingDebugged flag to evade debuggers. Unit 42 telemetry recorded over 1 million Modbus TCP devices exposed to the internet between September and October 2024.

Palo Alto Unit 42 · 27d agoMalware in the wild

Code to Cloud Platform Archives

Unit 42 archive page for Code to Cloud platform product-category articles; no new research or announcements.

This Unit 42 archive page lists product-category posts about Palo Alto Networks' Code to Cloud platform, which secures public cloud environments, SaaS applications and remote locations. It contains no new research, incidents, or announcements.

Palo Alto Unit 42 · 27d agoIndustry

Cortex Xpanse

Palo Alto Unit 42 Cortex Xpanse product-category page published with no article text available for classification.

The URL resolves to the Cortex Xpanse product category listing on the Unit 42 blog rather than a research article. No article body was provided, so no vulnerabilities, incidents, or research findings can be extracted.

Palo Alto Unit 42 · 27d agoIndustry

Multiple Vulnerabilities Discovered in a SCADA System

Unit 42 details five vulnerabilities (CVSS 7.0-7.8) in ICONICS Suite SCADA software enabling privilege escalation and DoS.

Unit 42 discovered five vulnerabilities (CVE-2024-1182, CVE-2024-7587, CVE-2024-8299, CVE-2024-8300, CVE-2024-9852) in ICONICS Suite versions 10.97.2 and earlier for Windows during a 2024 security assessment. The flaws, rated CVSS 7.0-7.8, allow DLL hijacking, privilege escalation, information disclosure, denial-of-service and potentially full system compromise. ICONICS Suite is a SCADA solution with hundreds of thousands of installations in over 100 countries, widely used in critical infrastructure, and several dozen servers are internet-exposed per Unit 42 telemetry. ICONICS released patches and advisories with workarounds in 2024.

Palo Alto Unit 42 · 27d agoVulnerabilityCVE-2024-1182CVE-2024-7587CVE-2024-8299+2 CVEs1

Privileged File System Vulnerability Present in a SCADA System

Unit 42 details CVE-2025-0921 (CVSS 6.5), a privileged file operations flaw in Iconics Suite enabling DoS and privilege escalation.

Unit 42 disclosed CVE-2025-0921 (CVSS 6.5), an execution-with-unnecessary-privileges flaw in the Pager Agent of the AlarmWorX64 MMX feature of Mitsubishi Electric Iconics Digital Solutions GENESIS64. Attackers could misuse privileged file system operations to corrupt critical binaries, causing denial-of-service or integrity loss on vulnerable SCADA systems. The analysis demonstrates a chain with CVE-2024-7587, which grants excessive permissions to the C:\ProgramData\ICONICS directory via the GenBroker32 installer. Iconics released an advisory with a workaround that addresses the reported issues.

Palo Alto Unit 42 · 27d agoVulnerabilityCVE-2025-0921CVE-2024-7587

A Deep Dive Into Attempted Exploitation of CVE-2023

Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.

Unit 42 observed large-scale automated scans attempting to exploit CVE-2023-33538 in end-of-life TP-Link TL-WR940N, TL-WR740N and TL-WR841N routers after CISA added the flaw to its KEV catalog in June 2025. HTTP GET requests inject commands via the ssid1 parameter at the /userRpm/WlanNetworkRpm endpoint to download and execute an arm7 ELF binary, a Mirai variant related to the Condi IoT botnet. Firmware emulation and reverse engineering showed the observed exploits are flawed and would fail, but the underlying vulnerability is real and successful exploitation requires authentication to the router's web interface. TP-Link confirmed the devices are end-of-life with no patches available and recommends replacing units and eliminating default credentials.

Palo Alto Unit 42 · 27d agoExploit / PoC in the wildCVE-2023-335381

TuxBot v3: Inside an IoT Botnet Framework With LLM

Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.

Palo Alto Unit 42 identified TuxBot v3 Evolution, a modular IoT botnet framework derived from AISURU, Wuhan-lineage botnets, and MHDDoS. The C-based bot brute-forces Telnet with 1,496 credential pairs, targets over 30 IoT device families, and communicates with a Go-based C2 over encrypted TCP with multiple fallback mechanisms including DGA, P2P, and DNS TXT. LLM-assisted development left hallucinated crypto implementations and broken exploit modules in the analyzed samples, though roughly 70% of core functionality works. Researchers warn polished production builds likely exist, raising the threat potential.

Palo Alto Unit 42 · 27d agoMalware1

Unit 42 Deep and Dark Web Service Archives

Palo Alto Networks Unit 42 describes its Deep and Dark Web service monitoring underground forums for compromised credentials and leaked data.

Unit 42's Deep and Dark Web Service page describes monitoring underground forums to identify compromised credentials and leaked data. Analysts investigate suspicious content, escalate prioritized findings, and deliver actionable intelligence to customer SOCs. The page is a service description rather than a news report or incident disclosure.

Palo Alto Unit 42 · 28d agoIndustry

Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)

Unit 42 reports actor TheHatman claims large-scale theft of Microsoft Entra credentials and provides mitigation guidance for credential attacks.

Palo Alto Networks Unit 42 published an updated threat brief on mitigating large-scale credential attacks. In August 2026, the actor TheHatman claimed to have stolen a large volume of credentials from organizations' Microsoft Entra tenants. The brief outlines defensive guidance for organizations facing large-scale credential attacks. The theft claims originate from the actor and the post focuses on mitigation steps.

Palo Alto Unit 42 · 28d agoThreat actor in the wild

Home & Small Office Wireless Routers Exploited to Attack Gaming Servers

Unit 42 details an updated Gafgyt botnet variant exploiting Zyxel, Huawei, and Realtek router vulnerabilities to recruit devices for DoS attacks on gaming servers.

Unit 42 researchers identified an updated Gafgyt variant derived from the JenX botnet that combines three remote code execution exploits: CVE-2017-18368 (Zyxel P660HN-T1A), CVE-2017-17215 (Huawei HG532), and CVE-2014-8361 (Realtek RTL81XX chipset). Shodan scans show more than 32,000 wireless routers worldwide potentially vulnerable to these exploits. The exploits act as droppers, pulling architecture-specific binaries from a malicious server (185.172.110.224), and the botnet performs denial-of-service attacks against gaming servers, most notably Valve Source engine servers.

Palo Alto Unit 42 · 28d agoMalware in the wildCVE-2017-18368CVE-2017-17215CVE-2014-8361

3 Vulnerabilities Found on AvertX IP Cameras

Unit 42 disclosed three vulnerabilities (CVE-2020-11623/4/5) in AvertX HD838 and 438IR IP cameras; AvertX has released patches.

Palo Alto Networks Unit 42 researchers found three vulnerabilities in AvertX HD838 and 438IR outdoor surveillance cameras, which are rebranded Hikvision products: CVE-2020-11625 (user enumeration), CVE-2020-11624 (weak password requirements), and CVE-2020-11623 (exposed dangerous method/function). User enumeration responses facilitate brute-force attacks, the default admin credentials (admin/1234) are never enforced to change, and physical access to an exposed UART interface allows bootloader access and configuration modification. AvertX released a patch, removed the UART connector, and disabled the interface in the latest production batch.

Palo Alto Unit 42 · 28d agoVulnerabilityCVE-2020-11625CVE-2020-11624CVE-2020-11623

Multiple ArtraDownloader Variants Used by BITTER to Target Pakistan

BITTER used three ArtraDownloader variants since 2015 to target Pakistan, China, and Saudi Arabia, deploying BitterRAT and exploiting CVE-2017-11882 in one wave.

Palo Alto Unit 42 documents ArtraDownloader, a previously unreported downloader family used by the suspected South Asian group BITTER, with three variants and roughly 80 unique samples dating back to February 2015. Between September 2018 and January 2019, BITTER used spearphishing documents hosted on compromised Pakistani websites to target Pakistan and, for the first time, Saudi Arabia; one RTF sample exploited the EQNEDT vulnerability CVE-2017-11882. The downloader retrieves BitterRAT over HTTP, uses simple registry keys for persistence, and byte-level string obfuscation. Infrastructure overlap with the previously reported MY24 InPage-exploit payload was also observed.

Palo Alto Unit 42 · 29d agoThreat actor in the wildCVE-2017-11882

TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks

TrickBot phishing campaign used SendGrid, fake Google Docs, and Drive-hosted downloaders disguised as Word files to deliver a credential-stealing payload.

Unit 42 identified a TrickBot distribution campaign on November 7-8, 2019, using payroll and annual bonus-themed emails sent from likely compromised .edu addresses through the legitimate SendGrid email delivery service. Emails contained links to Google Docs documents linking to downloader executables hosted on Google Drive, further masked behind SendGrid click-tracking URLs. The downloaders, signed by PERISMOUNT LIMITED and displayed with Microsoft Word icons, show a decoy pop-up and retrieve TrickBot payloads from compromised legitimate domains such as savute[.]in and lindaspryinteriordesign[.]com. The newer TrickBot variant stores its files and configuration under %APPDATA%\cashcore.

Palo Alto Unit 42 · 29d agoPhishing & fraud

xHunt Campaign: New Watering Hole Identified for Credential Harvesting

Unit 42 tied the xHunt campaign to a watering hole on a Kuwait government website used to passively harvest visitors' NTLM credential hashes.

Palo Alto Unit 42 identified a Kuwait government organization's webpage injected with hidden HTML referencing image paths on domains (microsofte-update.com, learn-service.com) tied to xHunt/Hisoka C2 infrastructure. When visitors loaded the page, Windows would attempt SMB/NetBIOS authentication to the remote share, allowing the operators to capture NTLM hashes that could be cracked or relayed. Related DNS redirect activity on xHunt infrastructure in 2019 pointed to additional credential-harvesting interest against Kuwaiti government email servers.

Palo Alto Unit 42 · 29d agoThreat actor in the wild

Cortex XDR™ Detects New Phishing Campaign Installing NetSupport Manager RAT

Cortex XDR threat hunters uncovered a phishing campaign delivering the NetSupport Manager RAT via a fake password-protected NortonLifelock Word document.

Unit 42 identified a January 2020 phishing campaign using a Microsoft Word document disguised as a password-protected NortonLifelock file. Enabling macros triggered an obfuscated command that built alpaca.bat in the temp directory, which used msiexec to download an MSI payload from quickwaysignstx.com, filtered on the Windows Installer user-agent string. The payload installed a PowerShell script and the campaign, which has delivered NetSupport Manager RAT since at least 2018, showed related activity dating back to early November 2019.

Palo Alto Unit 42 · 29d agoPhishing & fraud in the wild

Threat Assessment: Ryuk Ransomware

Unit 42 assesses Ryuk ransomware amid a CISA/FBI/HHS alert on threats to U.S. healthcare, including the UHS attack that disrupted hospital operations.

A joint CISA, FBI, and HHS alert on October 28, 2020 warned of an imminent threat to U.S. healthcare from operators deploying Trickbot and Ryuk ransomware. Universal Health Services reported a Ryuk attack that disrupted all U.S. UHS sites for weeks, with similar incidents at hospitals in Oregon and New York. Ryuk typically arrives after Trickbot or BazaLoader infections delivered via malicious email, and operators enumerate networks with PowerShell and WMI before encryption. The Trickbot Anchor_DNS module performs DNS tunneling for C2, using connectivity checks to benign domains like ipinfo.io and checkip.amazonaws.com.

Palo Alto Unit 42 · 29d agoRansomware in the wild

Threat Brief: Maze Ransomware

Unit 42 issued a threat brief on Maze ransomware, noting an uptick across industries and exploitation of Pulse VPN and IE flaws for initial access.

Palo Alto Networks detected an uptick in Maze ransomware samples across finance, healthcare, government, and other sectors. Maze, a variant of ChaCha ransomware first seen in May 2019, is distributed via weaponized Word/Excel attachments and the Spelevo exploit kit leveraging CVE-2018-15982 and CVE-2018-4878, and has used CVE-2019-11510 (Pulse VPN) and CVE-2018-8174 (Internet Explorer). Operators establish a foothold, escalate privileges, move laterally, and exfiltrate files before encryption for extortion leverage.

Palo Alto Unit 42 · 29d agoRansomware in the wildCVE-2018-15982CVE-2018-4878CVE-2019-11510+1 CVEs

Threat Assessment: Egregor Ransomware

Unit 42 assesses Egregor ransomware, a Sekhmet variant likely run by former Maze affiliates using Qakbot, IcedID, and Ursnif for initial access.

Since September 2020, Unit 42 observed Egregor ransomware attacks across the U.S., Europe, Asia-Pacific, and Latin America, coinciding with the Maze team's shutdown announcement. Egregor, a variant of the Sekhmet family, uses commodity malware such as Qakbot, IcedID, and Ursnif for initial access, followed by scripts that modify firewalls, enable RDP, and deploy Cobalt Strike for reconnaissance and exfiltration. A PowerShell script uninstalls the McAfee agent and downloads the Egregor DLL via BITS, executed with the -passegregor10 key. Victims face a three-day ransom deadline before exfiltrated data is published on the Egregor Hall of Shame leak site.

Palo Alto Unit 42 · 29d agoRansomware in the wild

Related CVEs

  • CVE-2026-03107.2—
    Buffer Overflow in PAN-OS XML Processing Enables Root RCE on PA-Series Firewalls
    Palo Alto Networks PAN-OS contains a buffer overflow (CWE-787, out-of-bounds write) in its XML processing functionality. An unauthenticated attacker with network access to the management web interface or the dataplane interface can send malicious XML input to trigger the flaw. On PA-Series hardware firewalls this allows arbitrary code execution with root privileges, while on VM-Series virtual firewalls the impact is limited to a denial-of-service condition. Panorama centralized management is also affected, and exposure is greatly reduced when the management interface is restricted to trusted internal IP addresses per vendor best practice. As of this analysis there is no known public proof-of-concept, no CISA KEV listing, and no confirmed exploitation in the wild (CVSS 4.0 marks exploitability as unproven).
    · Palo Alto Networks PAN-OS on PA-Series firewalls · Palo Alto Networks PAN-OS on VM-Series firewallslarge
  • CVE-2023-32878.8<1%
    A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system.
    A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system. This results in privilege escalation.
    · easyappointments easyappointments—
  • CVE-2023-32888.8<1%
    A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system.
    A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system. This results in privilege escalation.
    · easyappointments easyappointments—
  • CVE-2023-380518.1<1%
    A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary).
    A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary). This results in unauthorized access and unauthorized data manipulation.
    · easyappointments easyappointments—
  • CVE-2023-380548.1<1%
    A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer).
    A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer). This results in unauthorized access and unauthorized data manipulation.
    · easyappointments easyappointments—
  • CVE-2023-380508.1<1%
    A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin).
    A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
    · easyappointments easyappointments—
  • CVE-2024-75877.8<1%
    Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mi
    Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 versions 9.70.300.23 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.70.300.23 and prior, and Mitsubishi Electric MC Works64 all versions allows a…
    · iconics genesis64 · iconics mc works64—
  • CVE-2023-32896.5<1%
    A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin).
    A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin). This results in unauthorized data manipulation.
    · easyappointments easyappointments—
  • CVE-2024-13136.5<1%
    It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to
    It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized. Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and…
    —
  • CVE-2023-32905.0<1%
    A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system.
    A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results in unauthorized data manipulation.
    · easyappointments easyappointments—

Appears with

organization Unit 42 65organization Palo Alto Networks 59vendor Unit 42 31vendor Microsoft 23product Cortex XDR 14vendor Google 13vendor CrowdStrike 13vendor Trend Micro 8product Advanced URL Filtering 8product AutoFocus 7vendor Fortinet 7vendor SentinelOne 6product Prisma Access 6malware Angler EK 6organization Microsoft 5product Cortex Xpanse 5
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.