Unit 42 analyzes how AWS's AWSCompromisedKeyQuarantine managed policy automatically neutralizes exposed IAM access keys, plus monitoring strategies for quarantine events.
Unit 42 exposed CL-CRI-1171, a pay-per-install operation spreading OfferLoader and Insomnia RAT via YouTube and SEO poisoning to corporate and government targets.
Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.
Unit 42 links two Latin America campaigns where operators used Claude and GPT-4.1 during intrusions against government and financial targets.
Unit 42 exposes CL-CRI-1171, a pay-per-install network spreading malware like Insomnia RAT via YouTube channels and SEO poisoning for over two years.
Palo Alto Networks Unit 42 hosts a product archive page for its Cloud-Delivered Security Services subscription portfolio.
Palo Alto Networks Unit 42 markets its paid incident response services backed by threat intelligence and methodology from thousands of investigations.
Palo Alto Networks markets Cortex as an AI-driven security operations platform for detection, investigation, automation and response.
Palo Alto Networks positions Cortex XSIAM as a purpose-built platform to simplify security operations and speed incident remediation.
Palo Alto Networks Unit 42 hosts a product archive page for its Advanced DNS Security DNS-layer threat prevention service.
Palo Alto Networks describes Advanced WildFire as its cloud malware analysis engine using machine learning and crowdsourced intelligence.
Palo Alto Networks markets Advanced URL Filtering as combining a malicious URL database with real-time ML and DL web protection.
Mars Security launched Real-Time Intel-Based Detection, converting advisories from CISA and Mandiant into backtested MITRE ATT&CK-mapped detection rules for CrowdStrike, Wiz, and Splunk.
Palo Alto Networks Unit 42 markets Frontier AI Defense, a service combining frontier AI models and expert guidance to counter AI-powered attacks.
Unit 42 documents two AI-assisted intrusion campaigns against Latin American government, utility, and financial organizations using LLM-orchestrated tooling.
Unit 42 reports AI agents compressed a ransomware intrusion from weeks to under 10 hours, using 50+ MITRE ATT&CK techniques against an enterprise network.
Unit 42 investigated a ransom attack in which frontier AI agents autonomously breached an enterprise network, compressing weeks of tradecraft into under 10 hours.
Unit 42 page describes Idira, a Palo Alto Networks product providing dynamic privilege controls and zero standing privilege for AI agents.
Unit 42 research shows LLM safety refusals concentrate in a thin neural layer, motivating external, multi-layered AI security controls.
Unit 42's AI security assessment page describes Palo Alto Networks' offering for evaluating AI system security; no article text is available.
Palo Alto Networks Unit 42 published a threat bulletin, but no article body was available for detailed analysis.
Palo Alto Networks Unit 42 launched an OT Threat Research Lab to study how cyber threats disrupt industrial and critical-infrastructure operations.
Unit 42 warns attackers increasingly target CI/CD pipelines and developer tools rather than application code, urging full SDLC supply chain visibility.
Unit 42 archive page for Prisma Cloud product-category articles; contains no new research or announcements.
Unit 42 dissects FrostyGoop OT malware, which sent Modbus TCP commands to disrupt heating for 600+ apartment buildings in Ukraine.
Unit 42 archive page for Code to Cloud platform product-category articles; no new research or announcements.
Unit 42 details five vulnerabilities (CVSS 7.0-7.8) in ICONICS Suite SCADA software enabling privilege escalation and DoS.
Unit 42 details CVE-2025-0921 (CVSS 6.5), a privileged file operations flaw in Iconics Suite enabling DoS and privilege escalation.
Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.
Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.
Unit 42 identified MechaFlounder, a new Python backdoor used by the Chafer group to target a Turkish government entity via HTTP-based C2.
Aggah campaign abuses Bit.ly, BlogSpot, and Pastebin as multi-hop C2 to deliver RevengeRAT across the Middle East, US, Europe, and Asia.
xHunt deployed custom backdoors Hisoka, Killua, Gon, and EYE against Kuwait shipping and transportation organizations, using DNS tunneling and email-draft C2 channels.
xHunt's new CASHY200 PowerShell backdoor used DNS tunneling for C2; DNS security blocked beaconing at a Kuwait organization in September 2019.
Unit 42 analyzed 67 million malicious URLs and domains in H2 2022, a 52% increase, highlighting phishing impersonation and web skimmer trends.
Unit 42 details the Bad Likert Judge multi-turn jailbreak that abuses LLMs' evaluation capability, raising attack success rates over 60% across six frontier models.
Unit 42 demonstrates nine framework-agnostic attack scenarios against AI agents built with CrewAI and AutoGen, causing data leakage, credential theft and remote code execution.
Unit 42 PoC shows indirect prompt injection can poison Amazon Bedrock Agent long-term memory, enabling silent exfiltration of conversation history across future sessions.
Unit 42 unveils agent session smuggling, where a rogue AI agent hides covert instructions in established Agent2Agent (A2A) protocol sessions to manipulate victim agents.
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.
Today 644 readers · 778 views · 392 reads · all time 168K views