ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Vendor

Palo Alto Networks

24 mentions in 7 days · 83 in 30 days · 164 total · first seen · last

Search everything

Timeline

Unit 42 Deep and Dark Web Service Archives

Palo Alto Networks Unit 42 describes its Deep and Dark Web service monitoring underground forums for compromised credentials and leaked data.

Unit 42's Deep and Dark Web Service page describes monitoring underground forums to identify compromised credentials and leaked data. Analysts investigate suspicious content, escalate prioritized findings, and deliver actionable intelligence to customer SOCs. The page is a service description rather than a news report or incident disclosure.

Palo Alto Unit 42 · 29d agoIndustry

Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)

Unit 42 reports actor TheHatman claims large-scale theft of Microsoft Entra credentials and provides mitigation guidance for credential attacks.

Palo Alto Networks Unit 42 published an updated threat brief on mitigating large-scale credential attacks. In August 2026, the actor TheHatman claimed to have stolen a large volume of credentials from organizations' Microsoft Entra tenants. The brief outlines defensive guidance for organizations facing large-scale credential attacks. The theft claims originate from the actor and the post focuses on mitigation steps.

Palo Alto Unit 42 · 29d agoThreat actor in the wild

Home & Small Office Wireless Routers Exploited to Attack Gaming Servers

Unit 42 details an updated Gafgyt botnet variant exploiting Zyxel, Huawei, and Realtek router vulnerabilities to recruit devices for DoS attacks on gaming servers.

Unit 42 researchers identified an updated Gafgyt variant derived from the JenX botnet that combines three remote code execution exploits: CVE-2017-18368 (Zyxel P660HN-T1A), CVE-2017-17215 (Huawei HG532), and CVE-2014-8361 (Realtek RTL81XX chipset). Shodan scans show more than 32,000 wireless routers worldwide potentially vulnerable to these exploits. The exploits act as droppers, pulling architecture-specific binaries from a malicious server (185.172.110.224), and the botnet performs denial-of-service attacks against gaming servers, most notably Valve Source engine servers.

Palo Alto Unit 42 · Aug 18, 2026Malware in the wildCVE-2017-18368CVE-2017-17215CVE-2014-83611

3 Vulnerabilities Found on AvertX IP Cameras

Unit 42 disclosed three vulnerabilities (CVE-2020-11623/4/5) in AvertX HD838 and 438IR IP cameras; AvertX has released patches.

Palo Alto Networks Unit 42 researchers found three vulnerabilities in AvertX HD838 and 438IR outdoor surveillance cameras, which are rebranded Hikvision products: CVE-2020-11625 (user enumeration), CVE-2020-11624 (weak password requirements), and CVE-2020-11623 (exposed dangerous method/function). User enumeration responses facilitate brute-force attacks, the default admin credentials (admin/1234) are never enforced to change, and physical access to an exposed UART interface allows bootloader access and configuration modification. AvertX released a patch, removed the UART connector, and disabled the interface in the latest production batch.

Palo Alto Unit 42 · Aug 18, 2026VulnerabilityCVE-2020-11625CVE-2020-11624CVE-2020-11623

Multiple ArtraDownloader Variants Used by BITTER to Target Pakistan

BITTER used three ArtraDownloader variants since 2015 to target Pakistan, China, and Saudi Arabia, deploying BitterRAT and exploiting CVE-2017-11882 in one wave.

Palo Alto Unit 42 documents ArtraDownloader, a previously unreported downloader family used by the suspected South Asian group BITTER, with three variants and roughly 80 unique samples dating back to February 2015. Between September 2018 and January 2019, BITTER used spearphishing documents hosted on compromised Pakistani websites to target Pakistan and, for the first time, Saudi Arabia; one RTF sample exploited the EQNEDT vulnerability CVE-2017-11882. The downloader retrieves BitterRAT over HTTP, uses simple registry keys for persistence, and byte-level string obfuscation. Infrastructure overlap with the previously reported MY24 InPage-exploit payload was also observed.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wildCVE-2017-11882

TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks

TrickBot phishing campaign used SendGrid, fake Google Docs, and Drive-hosted downloaders disguised as Word files to deliver a credential-stealing payload.

Unit 42 identified a TrickBot distribution campaign on November 7-8, 2019, using payroll and annual bonus-themed emails sent from likely compromised .edu addresses through the legitimate SendGrid email delivery service. Emails contained links to Google Docs documents linking to downloader executables hosted on Google Drive, further masked behind SendGrid click-tracking URLs. The downloaders, signed by PERISMOUNT LIMITED and displayed with Microsoft Word icons, show a decoy pop-up and retrieve TrickBot payloads from compromised legitimate domains such as savute[.]in and lindaspryinteriordesign[.]com. The newer TrickBot variant stores its files and configuration under %APPDATA%\cashcore.

Palo Alto Unit 42 · Aug 17, 2026Phishing & fraud

xHunt Campaign: New Watering Hole Identified for Credential Harvesting

Unit 42 tied the xHunt campaign to a watering hole on a Kuwait government website used to passively harvest visitors' NTLM credential hashes.

Palo Alto Unit 42 identified a Kuwait government organization's webpage injected with hidden HTML referencing image paths on domains (microsofte-update.com, learn-service.com) tied to xHunt/Hisoka C2 infrastructure. When visitors loaded the page, Windows would attempt SMB/NetBIOS authentication to the remote share, allowing the operators to capture NTLM hashes that could be cracked or relayed. Related DNS redirect activity on xHunt infrastructure in 2019 pointed to additional credential-harvesting interest against Kuwaiti government email servers.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild1

Cortex XDR™ Detects New Phishing Campaign Installing NetSupport Manager RAT

Cortex XDR threat hunters uncovered a phishing campaign delivering the NetSupport Manager RAT via a fake password-protected NortonLifelock Word document.

Unit 42 identified a January 2020 phishing campaign using a Microsoft Word document disguised as a password-protected NortonLifelock file. Enabling macros triggered an obfuscated command that built alpaca.bat in the temp directory, which used msiexec to download an MSI payload from quickwaysignstx.com, filtered on the Windows Installer user-agent string. The payload installed a PowerShell script and the campaign, which has delivered NetSupport Manager RAT since at least 2018, showed related activity dating back to early November 2019.

Palo Alto Unit 42 · Aug 17, 2026Phishing & fraud in the wild1

Threat Assessment: Ryuk Ransomware

Unit 42 assesses Ryuk ransomware amid a CISA/FBI/HHS alert on threats to U.S. healthcare, including the UHS attack that disrupted hospital operations.

A joint CISA, FBI, and HHS alert on October 28, 2020 warned of an imminent threat to U.S. healthcare from operators deploying Trickbot and Ryuk ransomware. Universal Health Services reported a Ryuk attack that disrupted all U.S. UHS sites for weeks, with similar incidents at hospitals in Oregon and New York. Ryuk typically arrives after Trickbot or BazaLoader infections delivered via malicious email, and operators enumerate networks with PowerShell and WMI before encryption. The Trickbot Anchor_DNS module performs DNS tunneling for C2, using connectivity checks to benign domains like ipinfo.io and checkip.amazonaws.com.

Palo Alto Unit 42 · Aug 17, 2026Ransomware in the wild

Threat Brief: Maze Ransomware

Unit 42 issued a threat brief on Maze ransomware, noting an uptick across industries and exploitation of Pulse VPN and IE flaws for initial access.

Palo Alto Networks detected an uptick in Maze ransomware samples across finance, healthcare, government, and other sectors. Maze, a variant of ChaCha ransomware first seen in May 2019, is distributed via weaponized Word/Excel attachments and the Spelevo exploit kit leveraging CVE-2018-15982 and CVE-2018-4878, and has used CVE-2019-11510 (Pulse VPN) and CVE-2018-8174 (Internet Explorer). Operators establish a foothold, escalate privileges, move laterally, and exfiltrate files before encryption for extortion leverage.

Palo Alto Unit 42 · Aug 17, 2026Ransomware in the wildCVE-2018-15982CVE-2018-4878CVE-2019-11510+1 CVEs

Threat Assessment: Egregor Ransomware

Unit 42 assesses Egregor ransomware, a Sekhmet variant likely run by former Maze affiliates using Qakbot, IcedID, and Ursnif for initial access.

Since September 2020, Unit 42 observed Egregor ransomware attacks across the U.S., Europe, Asia-Pacific, and Latin America, coinciding with the Maze team's shutdown announcement. Egregor, a variant of the Sekhmet family, uses commodity malware such as Qakbot, IcedID, and Ursnif for initial access, followed by scripts that modify firewalls, enable RDP, and deploy Cobalt Strike for reconnaissance and exfiltration. A PowerShell script uninstalls the McAfee agent and downloads the Egregor DLL via BITS, executed with the -passegregor10 key. Victims face a three-day ransom deadline before exfiltrated data is published on the Egregor Hall of Shame leak site.

Palo Alto Unit 42 · Aug 17, 2026Ransomware in the wild

Exploits in the Wild for Citrix ADC and Citrix Gateway Directory Traversal Vulnerability CVE-2019

Unit 42 confirmed in-the-wild exploitation of CVE-2019-19781, a critical Citrix ADC/Gateway directory traversal flaw enabling unauthenticated file access and RCE.

CVE-2019-19781, a CVSS 9.8 directory traversal vulnerability, affects all supported versions of Citrix ADC and Citrix Gateway. Unit 42 captured multiple exploitation attempts in the wild and identified scanning activity from roughly 700 Shodan-exposed hosts. The flaw stems from improper pathname handling in Apache, allowing unauthenticated attackers to read sensitive files like smb.conf or achieve remote code execution via crafted XML. Palo Alto Networks released Threat Prevention signatures 57497 and 57570 on January 7, 2020, while Citrix published advisories CTX267027 and CTX267679 with responder policy mitigations pending a late-January patch.

Palo Alto Unit 42 · Aug 17, 2026Exploit / PoC in the wildCVE-2019-19781

The Year in Web Threats: Web Skimmers Take Advantage of Cloud Hosting and More

Unit 42 analyzed 2.24 million web threat incidents, finding web skimmers increasingly hosted on cloud infrastructure to steal payment card data.

Palo Alto Unit 42 analyzed 2,241,354 web threat incidents and 831,550 unique URLs detected via Advanced URL Filtering between October 2020 and September 2021. Threat activity peaked from October 2020 to January 2021, coinciding with the holiday shopping season, with most malicious domains geolocated to the United States, Russia, and Germany. Web skimmers ranked third among the top five threat classes and showed the most code diversity, making detection harder. Researchers observed more web skimmer families being hosted on cloud platforms to steal payment data and PII.

Palo Alto Unit 42 · Aug 17, 2026Research

Trends in Web Threats: Attackers Were More Active During Holiday Season

Unit 42 tracked 533,000 malicious landing URL incidents from October-December 2021, showing web threats peaked during the holiday shopping season.

Unit 42 detected 533,452 malicious landing URL incidents (120,753 unique) and 2,906,875 malicious host URL incidents (165,255 unique) from October through December 2021. Threat activity peaked in November, likely tied to Black Friday in the United States, United Kingdom, and Germany. Most malicious domains appeared to originate in the United States, followed by Russia and Germany. Personal sites, blogs, business sites, and shopping sites were the most common apparently benign entry points for attacks.

Palo Alto Unit 42 · Aug 17, 2026Research

Trends in Web Threats: Old Web Skimmer Still Active Today

Unit 42 detected 577,000 landing URL incidents in Q1 2022, with an old web skimmer family still actively stealing payment card data.

Palo Alto Unit 42 detected 577,275 landing URL incidents (116,643 unique) and 2,043,862 malicious host URL incidents (180,370 unique) between January and March 2022. Web threat volumes declined after the November 2021 holiday peak, but an old web skimmer family remained active. Business and economy sites overtook personal sites as the most common apparently benign entry points. Most malicious domains geolocated to the United States, Germany, and Russia, though proxy servers and VPNs obscure true locations.

Palo Alto Unit 42 · Aug 17, 2026Research

Trends in Web Threats in CY Q2 2022: Malicious JavaScript Downloaders Are Evolving

Unit 42 detected 751,000 landing URL incidents in Q2 2022 and documented malicious JavaScript downloaders evolving to evade detection.

Unit 42 detected 751,331 landing URL incidents (253,644 unique) and 1,744,629 malicious host URL incidents (256,844 unique) from April through June 2022. Total landing URL incidents rose compared with Q1 2022, and unique host URL incidents grew 42%, indicating attackers deploying more variants. The report includes a case study of a JavaScript downloader campaign demonstrating new evasion techniques. Personal sites, blogs, and business sites were the top apparently benign entry points.

Palo Alto Unit 42 · Aug 17, 2026Research

Recent Trends in Internet Threats: Common Industries Impersonated in Phishing Attacks, Web Skimmer Analysis and More

Unit 42 analyzed 67 million malicious URLs and domains in H2 2022, a 52% increase, highlighting phishing impersonation and web skimmer trends.

Unit 42 observed more than 67 million unique malicious URLs, domains and IPs between July and December 2022, a 52% increase over the first half of the year. Malicious JavaScript detections grew 99.3%, with over 4 million malicious JS samples hosted on 4.8 million URLs. Over 85% of hosting infrastructure was concentrated in eight countries, led by the United States, Brazil and China. The report also analyzes industries spoofed in phishing pages and includes a web skimmer case study on a Tranco top 1 million website.

Palo Alto Unit 42 · Aug 17, 2026Research

Old Wine in the New Bottle: Mirai Variant Targets Multiple IoT Devices

Unit 42 analyzed the Mirai IZ1H9 botnet variant exploiting Tenda, LB-Link, DCN and Zyxel flaws to build DDoS-capable IoT botnets.

Unit 42 observed the Mirai IZ1H9 variant on April 10, 2023, using a shell script downloader lb.sh from 163.123.143.126 to infect exposed Linux servers and networking devices. Campaigns running since November 2021 share infrastructure, near-identical bot functions and the XOR key 0xBAADF00D. The malware exploits CVE-2023-27076 (Tenda G103), CVE-2023-26801 (LB-Link), CVE-2023-26802 (DCN DCBI-Netlog-LAB) and a Zyxel RCE flaw. Compromised devices join a botnet used for DDoS attacks, and the downloader deletes logs and modifies iptables to block SSH, Telnet and HTTP recovery.

Palo Alto Unit 42 · Aug 17, 2026Malware in the wildCVE-2023-27076CVE-2023-26801CVE-2023-26802

Industrial and Operational Technology Archives

Unit 42's industrial OT security research category page summarizes coverage of ICS, critical infrastructure and AI-enabled operational environment risks.

This is a Unit 42 category index page for industrial and operational technology security research, not a standalone report. It describes coverage of industrial cybersecurity, ICS, critical infrastructure and AI-enabled operational environment risks.

Palo Alto Unit 42 · Aug 17, 2026Other

Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild

Attackers actively exploit CVE-2025-32433, a CVSS 10.0 unauthenticated RCE in Erlang/OTP SSH, heavily targeting OT and critical infrastructure networks.

CVE-2025-32433 enables unauthenticated RCE in Erlang/OTP's SSH daemon via SSH connection protocol messages (codes >= 80) processed before authentication, affecting versions before OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20. Unit 42 recorded a spike in exploitation between May 1-9, 2025, with 70% of detections on firewalls protecting OT networks, disproportionately affecting healthcare, agriculture, media and high technology. Observed payloads bind TCP-connected shells or launch Bash reverse shells to hosts like 146.103.40.203:6667, with randomized DNS lookups under dns.outbound.watchtowr.com indicating OAST-driven blind RCE validation.

Palo Alto Unit 42 · Aug 17, 2026Exploit / PoC in the wildCVE-2025-32433

New Malware 'Rover' Targets Indian Ambassador to Afghanistan

Unit 42 reports a spearphishing attack delivering the custom Rover Trojan to India's Ambassador to Afghanistan, exploiting CVE-2010-3333 in Word.

On December 24, 2015, Unit 42 identified a targeted spearphishing email spoofing Indian Defence Minister Manohar Parrikar, sent to India's Ambassador to Afghanistan. The RTF attachment exploited CVE-2010-3333 in Microsoft Word to download a downloader from newsumbrella.net, which retrieved the Rover Trojan and DLL plugins from 46.166.165.254. Rover uses OpenCV for webcam capture, OpenAL for audio recording and libsndfile for audio files, with data exfiltration over its C2 channel; separate payload versions target Windows XP and later systems.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wildCVE-2010-3333

KRBanker Targets South Korea Through Adware and Exploit Kits

Unit 42 details KRBanker banking trojan targeting South Korean bank users via KaiXin exploit kit and NEWSPOT adware, using pharming and process hollowing.

KRBanker (aka Blackmoon) is a banking trojan targeting online banking users in the Republic of Korea, with roughly 2,000 unique samples and 200+ pharming servers observed by Unit 42 over six months. It is distributed through the KaiXin exploit kit exploiting Adobe Flash CVE-2014-0569 and CVE-2015-3133, and through the NEWSPOT adware update channel that also delivers the Venik trojan. The trojan uses process hollowing, retrieves pharming server IPs from Qzone profile nickname fields, and abuses Proxy Auto-Config with a local proxy to redirect banking traffic to forged sites.

Palo Alto Unit 42 · Aug 17, 2026Malware in the wildCVE-2014-0569CVE-2015-3133

Tracking Elirks Variants in Japan: Similarities to Previous Attacks

Unit 42 links new Elirks backdoor variants attacking Japanese organizations to 2012 Taiwan attacks, delivered via spear-phishing PDFs exploiting Adobe Flash CVE-2011-0611.

Unit 42 analyzed new Elirks backdoor variants found in an attack on a Japanese business, noting strong similarities to 2012 attacks on Taiwanese ministries. The backdoor retrieves its C2 address from attacker-created accounts on Japanese blog and SNS services. Recent deliveries used an airline e-ticket lure named "E-TKT" with a PDF exploiting Adobe Flash CVE-2011-0611. Shared infrastructure and tactics with the Scarlet Mimic campaign suggest possible ongoing cyber espionage across East Asia.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wildCVE-2011-0611

MILE TEA: Cyber Espionage Campaign Targets Asia Pacific Businesses and Government Agencies

Unit 42 names MILE TEA, a cyber-espionage campaign since 2011 targeting Japanese and Taiwanese businesses and government agencies with e-ticket phishing lures and Elirks-family malware.

Unit 42 tracks the MILE TEA espionage campaign, observed as early as 2011, targeting Japanese trading, petroleum, and mobile companies, a Beijing office of a Japanese public organization, and a Taiwanese government agency. The primary infection vector is spear-phishing emails with attachments, mostly custom executable installers posing as flight e-tickets, dropping Elirks, Micrass, or Logedrut as initial bridgehead malware. Elirks and Logedrut retrieve encrypted C2 addresses from attacker-posted blog articles, decoded with Base64 and TEA or DES ciphers. The campaign's focus shifted from Taiwan to Japan around 2013.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild1

Banking Trojans: Ursnif Global Distribution Networks Identified

Unit 42 maps banking-trojan distribution networks: spam botnets push Shiotob downloaders and Ursnif, KINS, Tinba at Japan and European targets via compromised web servers.

Unit 42 identified the distribution networks behind banking trojan attacks against Japan, Italy, Spain, Poland, Australia, and Germany. A spam botnet delivered 75 unique Shiotob (Bebloh/URLZone) variants across 7 million spam emails, with Shiotob acting mainly as a downloader that installs Ursnif and the Pushdo spam bot from C2 commands. Over 200 malicious files were hosted on 74 compromised, mostly European small-business web servers between April 2015 and January 2017, with localized invoice and photo-themed email lures per target country.

Palo Alto Unit 42 · Aug 17, 2026Malware in the wild

UBoatRAT Navigates East Asia

Unit 42 discovers UBoatRAT, a new custom RAT targeting South Korean and video-game industry personnel, delivered via Google Drive with GitHub-based C2 and BITS persistence.

Unit 42 identified UBoatRAT, a new custom remote access trojan first found in May 2017, whose initial version used a public Hong Kong blog service and a compromised Japanese web server for command and control. The latest variants target personnel or organizations related to South Korea or the video games industry, are delivered through Google Drive, and masquerade as Microsoft Word, Excel, or folder icons. The RAT checks for virtualization software and domain join, retrieves its C2 address from a Base64-encoded string in a GitHub-hosted file, uses a custom XOR-encrypted C2 protocol, and maintains persistence via Windows Background Intelligent Transfer Service (BITS) jobs that survive reboots.

Palo Alto Unit 42 · Aug 17, 2026Malware in the wild1

“Tick” Group Continues Attacks

Unit 42 tracks the Tick espionage group attacking Korean and Japanese defense and high-tech targets with Daserf, Minzen, 9002, Invader, and custom Gh0st RAT variants.

The Tick group has conducted long-running espionage attacks against organizations in the Republic of Korea and Japan, focusing on defense and high-tech companies holding intellectual property, and repeatedly attacked one high-profile Japanese target for three years. Unit 42 links the Daserf backdoor, the 9002 RAT, and the Invader backdoor through shared C2 infrastructure used between July 2012 and April 2013. Minzen samples install a "NamelessHdoor" backdoor derived from publicly available code over a decade old, modified with ReflectiveDLLLoader DLL injection, and the group also uses custom Gh0st RAT variants. Tick has shifted from privacy-protected domain registration to compromised websites for C2 infrastructure.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild1

Tick Group Weaponized Secure USB Drives to Target Air

Unit 42 says the Tick group weaponized South Korean certified secure USB drives with SymonLoader malware to reach air-gapped Windows XP systems.

Unit 42 discovered that the Tick cyberespionage group, which targets Japan and South Korea, compromised an ITSCC-certified secure USB drive made by a South Korean defense company and used a new loader named SymonLoader to extract a hidden executable from these drives. SymonLoader only infects Windows XP and Windows Server 2003, suggesting deliberate targeting of legacy air-gapped systems used by government and defense organizations. The group also delivered HomamDownloader and SymonLoader via Trojanized Korean and Japanese software sent as spearphishing attachments. Unit 42 believes the attacks occurred multiple years ago and that this malware is not part of an active campaign.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild1

Bisonal Malware Used in Attacks Against Russia and South Korea

Unit 42 details a Bisonal malware variant, active since 2014, targeting Russian and South Korean defense organizations via PDF-disguised spearphishing emails.

In early May, Unit 42 discovered a campaign delivering a Bisonal malware variant against at least one Russian communications security and cryptography company and one unidentified organization in South Korea. The variant, in the wild since at least 2014, introduces a new C2 cipher and rewritten networking and persistence code, with only 14 samples collected to date. Attackers spoofed Russian state corporation Rostec in spearphishing emails carrying an executable disguised with a PDF icon; the dropper decrypts an RC4-encrypted DLL and establishes persistence via a registry Run key. Bisonal has been used since 2013 against government, military, and defense targets in South Korea, Russia, Japan, and India, alongside successors Bioazih and Dexbia.

Palo Alto Unit 42 · Aug 17, 2026Malware in the wild

Analysis of Smoke Loader in New Tsunami Campaign

Fake Japanese Meteorological Agency tsunami warning emails delivered Smoke Loader and AzoRult malware to steal credentials from targets in Japan.

A fake tsunami warning email impersonating Japan's Meteorological Agency asked recipients to click a link on a registered fake agency domain, delivering the commodity loader Smoke Loader to targets in Japan. Smoke Loader, active since 2011, is modular, and its payloads have included banking trojans, ransomware, cryptominers, password stealers, and PoS malware; the campaign later also deployed AzoRult. New samples add junk-jump obfuscation, encrypted network traffic and payload files, a unique machine ID used for tracking and encryption, and PROPagate injection into explorer.exe, with persistence via a Startup folder shortcut and RC4-encrypted C2 communication.

Palo Alto Unit 42 · Aug 17, 2026Malware in the wild

Tracking OceanLotus’ new Downloader, KerrDown

Unit 42 identifies KerrDown, a new OceanLotus (APT32) downloader active since 2018 targeting Vietnamese speakers via malicious macros and DLL side-loading.

Unit 42 tracks KerrDown, a previously undocumented downloader family used by OceanLotus (APT32) since at least early 2018, primarily targeting Vietnam or Vietnamese-speaking individuals. Delivery uses macro-laced Microsoft Office documents embedding base64-encoded 32-bit and 64-bit DLLs, and RAR archives containing a legitimate program abused for DLL side-loading. KerrDown is dropped as main_background.png, downloads a DES-encrypted payload from a URL, and executes it directly in memory. Researchers used Jaccard-index similarity analysis to identify the new family, connect campaign samples, and infer patterns in the group's working hours and days.

Palo Alto Unit 42 · Aug 17, 2026Malware in the wild1

ApateWeb: An Evasive Large-Scale Scareware and PUP Delivery Campaign

Unit 42 uncovers ApateWeb, a campaign using over 130,000 domains and multilayered redirects to deliver scareware, adware and PUPs to millions of users.

Unit 42 discovered ApateWeb, a large-scale campaign using a network of more than 130,000 domains to deliver scareware, potentially unwanted programs, adware including a rogue browser and browser extensions, and scam pages. The campaign uses a three-layer structure with deceptive emails as the entry point, centralized victim tracking via UUIDs, intermediate adware or anti-bot redirections, and evasion tactics such as cloaking, bot detection error pages, and wildcard DNS abuse. Activity spiked since August 2022, with several hundred attacker-controlled sites remaining in Tranco's top 1 million rankings and millions of monthly hits; Unit 42 blocked an estimated 3.5 million sessions across 74,711 devices in November 2023.

Palo Alto Unit 42 · Aug 17, 2026Phishing & fraud in the wild

Scam Attacks Taking Advantage of the Popularity of the Generative AI Wave

Unit 42 finds about 225 generative AI-themed domains registered daily since ChatGPT's launch, with nearly 29 percent suspicious, fueling scams and PUP delivery.

Palo Alto Networks analyzed new domain registrations containing generative AI keywords such as chatgpt, prompt, and sora since ChatGPT's November 2022 launch, observing around 225 GenAI-related registrations per day. About 28.75 percent of these domains are suspicious, a rate 22 times higher than for general new domains, with registration spikes aligning with milestones like Bing ChatGPT integration, the GPT-4 release, new GPTs, and OpenAI's Sora announcement. Over 72 percent of the domains use gpt or chatgpt keywords, and gpt domains show a 76 percent suspicious rate. Case studies cover PUP delivery, spam distribution, and monetized domain parking, with 35 percent of traffic to these domains directed at suspicious ones.

Palo Alto Unit 42 · Aug 17, 2026Phishing & fraud in the wild1

Autoencoder Is All You Need: Profiling and Detecting Malicious DNS Traffic

Palo Alto Unit 42 details an autoencoder-based method that profiles DNS traffic to detect C2 and malicious domains, blocking ~374,000 malicious DNS requests daily.

Unit 42 built an RNN-based autoencoder that compresses DNS traffic time series into fixed-dimensional 'DNS profiles' for each domain and device. Downstream classification, clustering, and anomaly detection modules flag suspicious domains, capturing 170 emerging suspicious domains in May 2024. Signatures block roughly 374,000 malicious DNS requests daily and run in the Advanced DNS Security service, with detections shared to Advanced URL Filtering. Case studies link DNS traffic patterns to C2 beaconing, dynamic DNS abuse, and DNS tunneling for data exfiltration.

Palo Alto Unit 42 · Aug 17, 2026Research

TLD Tracker: Exploring Newly Released Top

Unit 42 tracked 19 newly released top-level domains and found large-scale phishing, unwanted program distribution, and cybersquatting tied to TLD launch dates.

Researchers analyzed 19 new generic TLDs, including .zip, .bot, .ing, and .meme, released or approaching general availability over roughly 18 months. Data from passive DNS, registry zone files, newly registered domain feeds, and the Tranco top-1M list showed phishing campaigns, potentially unwanted program distribution, and domain squatting on these TLDs. Abuse correlated with each TLD's rollout phases, indicating attackers monitor general availability dates to register and weaponize domains. The IANA root database now lists over 1,000 generic TLDs.

Palo Alto Unit 42 · Aug 17, 2026Research

Automatically Detecting DNS Hijacking in Passive DNS

Unit 42's machine learning pipeline detected 6,729 DNS hijacking events between March and September 2024, hitting political parties, ISPs, and universities.

Unit 42 processes roughly 167 million new DNS records daily and applies a machine learning model using 74 features over 169 TB of passive DNS and geolocation data to flag hijacked domains. From March to September 2024 the pipeline screened over 29 billion records and classified 6,729 as DNS hijacking, averaging 38 detections per day; a new model detects hijacks in customer traffic within about 10 minutes. Notable cases include a Hungarian political party's hijacked domain, defacement of a large utility company and ISP, and university and research center domains repurposed for illicit gambling. DNS hijacking typically relies on stolen registrar or DNS provider credentials or cache poisoning, enabling MitM attacks, phishing, drive-by downloads, and scams.

Palo Alto Unit 42 · Aug 17, 2026Research in the wild

Network Abuses Leveraging High-Profile Events: Suspicious Domain Registrations and Other Scams

Unit 42 found scammers surge deceptive domain registrations around major events like the 2024 Paris Olympics to run phishing and counterfeit merchandise scams.

Unit 42 analyzed newly registered domains (over 200,000 detected daily from zone files, WHOIS, and passive DNS) containing event-specific keywords, using the 2024 Paris Summer Olympics as a case study. Threat actors register lookalike domains to sell counterfeit merchandise, push fraudulent services, and run phishing, as previously seen with COVID-19-themed and fake ChatGPT tool scams. The article recommends monitoring domain registrations, DNS and URL traffic trends, textual patterns, and verdict change requests to catch event-themed abuse early.

Palo Alto Unit 42 · Aug 17, 2026Phishing & fraud in the wild

Beneath the Surface: Detecting and Blocking Hidden Malicious Traffic Distribution Systems

Unit 42 built an ML-based detector for malicious traffic distribution systems, finding malicious TDS chains average longer redirections and more URLs than legitimate ones.

Traffic distribution systems redirect victims through chains of intermediate domains to hide final destinations, serving phishing, malvertising, and online gambling operations. Unit 42's topological analysis of redirection graphs found malicious TDS traffic uses longer chains (about 25% exceed four hops vs 10% benign), more URLs (median 126 vs 80), and fewer isolated subgraphs with higher connectivity. These features power an ML detector integrated into Advanced DNS Security and Advanced URL Filtering to identify and block malicious TDS infrastructure in customer traffic.

Palo Alto Unit 42 · Aug 17, 2026Research

The Smishing Deluge: China-Based Campaign Flooding Global Text Messages

Unit 42 attributes a global smishing campaign with 194,000+ phishing domains impersonating tolls, banks, and couriers to the Smishing Triad.

Palo Alto Unit 42 attributes ongoing smishing texts about toll violations and package misdelivery to the Smishing Triad, targeting U.S. residents since April 2024. Researchers identified 194,345 FQDNs across 136,933 root domains registered since January 2024, mostly via Hong Kong registrar Dominet (HK) Limited with Chinese nameservers and hosting concentrated on U.S. cloud services. The decentralized campaign impersonates banking, cryptocurrency, e-commerce, healthcare, law enforcement, and social media services, and its scale points to a large phishing-as-a-service operation. Phishing pages harvest national ID numbers such as Social Security numbers, home addresses, payment details, and login credentials.

Palo Alto Unit 42 · Aug 17, 2026Phishing & fraud in the wild1

Almost Half of Malware Samples Communicate Direct to IP

Unit 42 analysis of 4 million malware reports finds 45% of C2-active samples connect directly to hard-coded IPs, bypassing DNS defenses.

Palo Alto Unit 42 analyzed over 4 million Advanced WildFire dynamic analysis reports and found that 45.32% of malware samples with C2 activity made at least one direct-to-IP connection, accounting for 23.17% of all C2 connection attempts. The firm proposes zero trust IP (ZT-IP), an enforcement approach that verifies whether outbound destinations were ever sanctioned by a DNS response. ZT-IP analysis surfaced Phorpiex ransomware droppers fetching payloads directly from C2 IPs, a persistent data exfiltration campaign using an obfuscated \GET protocol, and Mozi P2P botnet payloads delivered to IoT devices without DNS. Only 1% of benign samples connected directly to untrusted IP addresses.

Palo Alto Unit 42 · Aug 17, 2026Research1

Related CVEs

  • CVE-2026-03107.2—
    Buffer Overflow in PAN-OS XML Processing Enables Root RCE on PA-Series Firewalls
    Palo Alto Networks PAN-OS contains a buffer overflow (CWE-787, out-of-bounds write) in its XML processing functionality. An unauthenticated attacker with network access to the management web interface or the dataplane interface can send malicious XML input to trigger the flaw. On PA-Series hardware firewalls this allows arbitrary code execution with root privileges, while on VM-Series virtual firewalls the impact is limited to a denial-of-service condition. Panorama centralized management is also affected, and exposure is greatly reduced when the management interface is restricted to trusted internal IP addresses per vendor best practice. As of this analysis there is no known public proof-of-concept, no CISA KEV listing, and no confirmed exploitation in the wild (CVSS 4.0 marks exploitability as unproven).
    · Palo Alto Networks PAN-OS on PA-Series firewalls · Palo Alto Networks PAN-OS on VM-Series firewallslarge
  • CVE-2023-32878.8<1%
    A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system.
    A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system. This results in privilege escalation.
    · easyappointments easyappointments—
  • CVE-2023-32888.8<1%
    A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system.
    A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system. This results in privilege escalation.
    · easyappointments easyappointments—
  • CVE-2023-380518.1<1%
    A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary).
    A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary). This results in unauthorized access and unauthorized data manipulation.
    · easyappointments easyappointments—
  • CVE-2023-380548.1<1%
    A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer).
    A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer). This results in unauthorized access and unauthorized data manipulation.
    · easyappointments easyappointments—
  • CVE-2023-380508.1<1%
    A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin).
    A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
    · easyappointments easyappointments—
  • CVE-2024-75877.8<1%
    Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mi
    Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 versions 9.70.300.23 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.70.300.23 and prior, and Mitsubishi Electric MC Works64 all versions allows a…
    · iconics genesis64 · iconics mc works64—
  • CVE-2023-32896.5<1%
    A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin).
    A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin). This results in unauthorized data manipulation.
    · easyappointments easyappointments—
  • CVE-2024-13136.5<1%
    It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to
    It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized. Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and…
    —
  • CVE-2023-32905.0<1%
    A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system.
    A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results in unauthorized data manipulation.
    · easyappointments easyappointments—

Appears with

organization Unit 42 66organization Palo Alto Networks 59vendor Unit 42 31vendor Microsoft 27vendor CrowdStrike 18product Cortex XDR 14vendor Google 14vendor Trend Micro 11vendor Wiz 11vendor Fortinet 9product Prisma Cloud 8product Advanced URL Filtering 8product AutoFocus 7product Prisma Access 7vendor SentinelOne 7vendor Sophos 6
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.