ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Military Unit 29155”

29 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllPolicy & legal 11Malware 4Threat actor 3Exploit / PoC 2Ransomware 2Vulnerability 2
SeverityAllcritical 17high 1medium 4low 2info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Coast Guard, FBI boarded tanker after attack by ‘foreign cyber actors’

US Coast Guard and FBI boarded an oil tanker after foreign hackers compromised its network; VL Prosperity reportedly lost communications for 30 hours.

The US Coast Guard confirmed that a specialized team including USCG Cyber Protection Team members and FBI Cyber Action Team operators boarded a tanker on August 21 after indications its network was compromised by foreign cyber actors. Bloomberg identified one vessel as VL Prosperity; Iranian state-linked outlet Mehr reported it lost communications for 30 hours after an August 7 attack while transiting the Strait of Gibraltar, with a crew member alleging attackers increased engine speed and disabled fuel and engine-oil tanks. No operational disruptions or environmental impacts were reported, no group has claimed responsibility, and Russian analysts linked the incident to US-Iran tensions. A day before the alleged attack, North Carolina Ports reported a cyberattack that forced a shift to manual operations.

The Record · 7h agoData breach in the wild 2 sources

2,000 Leaked Documents Reveal How Russia Turns Engineering Students Into GRU Cyber Operators

Leaked Bauman Moscow State Technical University files reveal a hidden GRU training pipeline feeding APT28 and Sandworm units.

More than 2,000 leaked Bauman Moscow State Technical University documents show that Department No. 4, a hidden program inside the Military Training Center, trained roughly 250 career and reserve students for GRU cyber and intelligence roles across six academic years. Graduates were linked to Military Unit 26165 (APT28), Unit 74455 (Sandworm/APT44) and Unit 29155, and former Unit 26165 commander Viktor Netyksho was involved in department oversight. Reporting by The Insider, The Guardian, Le Monde, Der Spiegel and other outlets, with independent analysis by DomainTools, estimates 10-15 students annually were selected for GRU-related assignments before graduating.

Security Affairs · 13d agoThreat actor1

Is Someone Hacking DoD Refrigerators?

Refrigeration outages hit commissaries at seven US military installations, with hacking suspected but not confirmed by the Pentagon.

Refrigeration disruptions were reported at Defense Commissary Agency commissaries at Fort Irwin, F.E. Warren AFB, Fort Huachuca, Naval Station Newport, Columbus AFB, Travis AFB, and Naval Air Station Lemoore. A defense official acknowledged awareness of a possible refrigeration disruption, but the services and Pentagon declined to provide details. The post is speculative, arguing the coincidence of outages suggests possible hacking, though no evidence or attribution is provided.

Schneier on Security · 16d agoData breach

Unit 42 Incident Response Archives

Palo Alto Networks Unit 42 markets its paid incident response services backed by threat intelligence and methodology from thousands of investigations.

This is a vendor product page describing Unit 42's incident response offering rather than a news article. It emphasizes containing, remediating and eradicating attacks using threat intelligence and a methodology developed from real-world incident casework. No new incident, vulnerability, or actor activity is reported.

Palo Alto Unit 42 · 8d agoIndustry 6 sources

Unit 42 Frontier AI Defense Archives

Palo Alto Networks Unit 42 markets Frontier AI Defense, a service combining frontier AI models and expert guidance to counter AI-powered attacks.

Unit 42 Frontier AI Defense is positioned as an elite service to neutralize AI-powered attacks before they scale, combining access to frontier AI models with Unit 42 expertise. It assesses customer security stacks against AI-driven attack techniques and offers hands-on guidance to modernize security operations. The page is primarily a product category description without new incident or vulnerability details.

Palo Alto Unit 42 · 12d agoTools

I Think the Military Commissary Freezers Were Hacked

Refrigeration failures at six-plus US military commissaries prompt speculation of a cyber attack on DeCA's remote monitoring systems; Pentagon acknowledges possible disruption.

The author documents near-simultaneous freezer and refrigeration failures at confirmed installations including Fort Huachuca, F.E. Warren AFB, Fort Irwin and Travis AFB on August 26-27, with freezers entering defrost mode that heated and spoiled food. DeCA's Remote Monitoring Control System controls defrost across roughly 182 locations, and an unverified comment attributed the Fort Huachuca failure to a network issue. Stars and Stripes and Military Times independently reported the multi-base failures, and the Pentagon acknowledged a 'possible refrigeration disruption,' though no evidence of hacking has been confirmed.

Lobsters · security · 13d agoData breach

Unit 42 Deep and Dark Web Service Archives

Palo Alto Networks Unit 42 describes its Deep and Dark Web service monitoring underground forums for compromised credentials and leaked data.

Unit 42's Deep and Dark Web Service page describes monitoring underground forums to identify compromised credentials and leaked data. Analysts investigate suspicious content, escalate prioritized findings, and deliver actionable intelligence to customer SOCs. The page is a service description rather than a news report or incident disclosure.

Palo Alto Unit 42 · 29d agoIndustry

Ai Security Assessment

Unit 42's AI security assessment page describes Palo Alto Networks' offering for evaluating AI system security; no article text is available.

The item is a Palo Alto Networks Unit 42 product category page for 'AI security assessment' with no article body. It likely indexes Unit 42 content or services related to assessing the security of AI systems. No concrete incidents, vulnerabilities, or research findings are described.

Palo Alto Unit 42 · 19d agoAI safety & security

Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government

Unit 42 attributes three espionage clusters targeting a Southeast Asian government to Stately Taurus, Alloy Taurus, and Gelsemium APTs.

Unit 42 investigated espionage attacks starting in late 2022 against multiple governmental entities in a Southeast Asian country, including critical infrastructure, public healthcare, financial administrators, and ministries. Analysis revealed three distinct clusters: CL-STA-0044 attributed to Stately Taurus (Mustang Panda), CL-STA-0045 to Alloy Taurus (GALLIUM), and CL-STA-0046 to Gelsemium. The first cluster used a ToneShell backdoor variant, ShadowPad, China Chopper web shells, Impacket, and credential dumping tools across roughly Q1 2021 to Q3 2023. All three operated with distinct tools, infrastructure, and long-term surveillance tradecraft consistent with APTs.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild

US military disabled ad tracking on troops’ devices following reports of targeted attacks

US DoD disabled ad tracking on troops' devices after foreign adversaries targeted service members using commercially bought location data.

Per letters shared with Senator Ron Wyden, the Army, Air Force, Navy, Marine Corps, and Special Operations Command disabled advertising IDs on iPhones, Android devices, and Windows computers across the federal military enterprise. The protections rolled out earlier in 2026, with the Air Force implementing changes in July, to prevent adversaries from exploiting app-derived location data sold through data brokers. Wyden warned that personal devices brought onto military bases could still expose troops and facilities, and noted the intelligence community and FBI buy such data without warrants.

TechCrunch · Security · 12d agoPolicy & legal

INTERPOL Operation Jackal IV Arrests 58, Identifies 263 in Global Cyber Fraud Crackdown

INTERPOL's Operation Jackal IV arrested 58 and identified 263 suspects in West African cyber-fraud networks, seizing millions across 22 countries.

Operation Jackal IV, run by INTERPOL with 22 countries between November 2025 and June 2026, targeted West African organized crime groups such as Black Ace behind romance, investment, and business email compromise fraud. It produced 58 arrests and 263 identified suspects, including 17 arrests tied to a crime-as-a-service network providing domains and money laundering support to 196 identified individuals. Raids in Johannesburg netted 39 arrests, $2.67 million seized, and 257 blocked bank accounts, while a Romanian call-center investment scheme had stolen an estimated 143 million euros (~$166 million) and led to 11 arrests. The operation is the fourth iteration, following waves in 2022, 2023, and 2024 with 75, 103, and 300 arrests respectively.

The Hacker News · 21d agoPolicy & legal

Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent

Unit 42 details Patchwork APT campaigns against the Indian subcontinent using EPS exploits and an updated BADNEWS backdoor targeting Pakistani military and nuclear interests.

Unit 42 observed the Patchwork group (also known as Dropping Elephant and Monsoon) conducting campaigns against targets in the Indian subcontinent using weaponized documents that exploit CVE-2015-2545 and CVE-2017-0261. The documents deliver an updated BADNEWS backdoor that grants attackers full control of victim machines, using dead drop resolvers on legitimate third-party websites for C2 and HTTP for communications. Lures referenced Pakistan Army promotions, the Pakistan Atomic Energy Commission and the Ministry of the Interior, and in late January 2018 the group shifted from CVE-2017-0261 to the older CVE-2015-2545.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wildCVE-2015-2545CVE-2017-0261

Unit 42 - Latest Cyber Security Research

Unit 42 briefing warns frontier AI models compress exploit development timelines and highlights 2026 incident response report findings on AI-accelerated attacks.

Palo Alto Networks Unit 42 published a threat briefing and Global Incident Response Report arguing that frontier AI models enable threat actors to move from initial access to exfiltration in minutes rather than months. The report found attacks are 4x faster, 65% of initial access is driven by identity-based techniques, and 87% of attacks unfold across multiple surfaces. The briefing offers CISO guidance on prioritizing defenses against AI-accelerated, automated attacks.

Palo Alto Unit 42 · 28d agoAI safety & security

Aggah Campaign: Bit.ly, BlogSpot, and Pastebin Used for C2 in Large Scale Campaign

Aggah campaign abuses Bit.ly, BlogSpot, and Pastebin as multi-hop C2 to deliver RevengeRAT across the Middle East, US, Europe, and Asia.

Unit 42 details the Aggah campaign, which began with spearphishing emails in March 2019 spoofing a large financial institution and targeting education, media/marketing, and government organizations in the Middle East, later expanding to the US, Europe, and Asia. Delivery documents use Template Injection to load a remote OLE file whose macro runs mshta against a Bit.ly link redirecting to a BlogSpot post, which then uses Pastebin pastes to download RevengeRAT configured with a duckdns[.]org C2 domain. The embedded script also deletes Microsoft Defender signatures and kills Defender and Office processes, and modifies registry keys to enable macros. High-level TTPs resemble the Gorgon Group, but Unit 42 could not confirm attribution.

Palo Alto Unit 42 · Aug 17, 2026Threat actor

The Collective Cyber Defense letter wrote your next vendor questionnaire

Op-ed argues the 200-company Collective Cyber Defense letter's three endorsed metrics should become standard vendor procurement questions.

More than 200 companies including Microsoft, Google, AWS, CrowdStrike, Anthropic and Okta signed an August 27 open letter calling for faster cyber defenses against AI-enabled attacks. The letter endorses three measurable metrics: coverage, containment speed, and verified remediation. The author turns those into five concrete procurement questions buyers should pose at vendor renewals, while noting the letter contains no deadlines, dollar figures or measurable targets.

CyberScoop · 15d agoIndustry

US offers $10 million for info on Iranian leaders behind CyberAv3ngers water utility attacks

The US offered $10 million for information on six IRGC-CEC officials behind CyberAv3ngers' 2023 hacks of Unitronics PLCs at US water utilities.

The State Department named six Iranian security officials, including IRGC Cyber-Electronic Command head Hamid Reza Lashgarian, and offered up to $10 million for information on their whereabouts. CyberAv3ngers publicly claimed compromises of Israel-made Unitronics Vision PLCs in October 2023, forcing the Municipal Water Authority of Aliquippa, Pennsylvania, to take systems offline and switch to manual operations. The US had sanctioned the six men in February for targeting critical infrastructure, and CISA notified water operators using Unitronics devices while urging default-password changes. A watchdog also criticized the EPA for lacking a comprehensive water-sector cyber risk strategy.

The Record · 9d agoPolicy & legal in the wild 3 sources

Cyberattack on logistics giant Ceva hits retailers and Steam customers across Europe

Cyberattack on Ceva Logistics disrupted eight European warehouses, delaying shipments for Bol, De Bijenkorf, Ajax and exposing Steam hardware buyers' data.

A cyberattack on Ceva Logistics disrupted operations at eight European warehouses, delaying shipments for Bol, De Bijenkorf, Ace & Tate, Ajax and Steam hardware customers. Attackers accessed two Ceva systems processing Bol orders, potentially exposing names, addresses, phone numbers, email addresses and order details. Valve began notifying European Steam customers whose hardware shipping data may have been compromised and is contacting data protection authorities. Ceva, with about 110,000 employees and over 1,700 facilities, has not disclosed the attackers or whether ransomware was involved.

The Record · Aug 11, 2026Data breach in the wild

U.S. Offers $10 Million Reward for Iranian IRGC Cyber Chief Linked to Critical Infrastructure Attacks

The U.S. State Department offered up to $10 million for information on Amir Yaryab, an IRGC cyber chief linked to critical infrastructure attacks.

The U.S. State Department's Rewards for Justice program offers up to $10 million for information identifying or locating Amir Yaryab, who allegedly oversees the Cyber Operations Command of Iran's IRGC Cyber-Electronic Command (IRGC-CEC). Officials tie him to units called Shahid Hemmat and Shahid Shushtari conducting cyber and information campaigns against defense, telecommunications, energy, and finance sectors across the US, Europe, and the Middle East, and to groups including CyberAv3ngers and Dadeh Afzar Arman. CyberAv3ngers compromised at least 75 Unitronics Vision Series PLCs, including 34 in US water and wastewater facilities, between November 2023 and January 2024.

Cyber Security News · 8d agoPolicy & legal

31st August – Threat Intelligence Report

Manchester Airports Group disclosed a cyberattack exposing contact details of about 8.7 million customers across Manchester, Stansted, and East Midlands airports.

Manchester Airports Group, the UK operator of Manchester, London Stansted, and East Midlands airports, disclosed a cyberattack that exposed data belonging to roughly 8.7 million customers. Check Point's weekly threat intelligence bulletin reports the compromised information includes contact details. The disclosure appeared in Check Point's 31 August Threat Intelligence Report covering the week's top attacks and breaches.

Check Point Research · 16d agoData breach in the wild

Trump Targets Foreign Technology in New U.S. Power Grid Security Order

Trump's Executive Order 14420 declares a national emergency to restrict foreign-made bulk-power grid equipment over cyber, sabotage and supply-chain risks.

Executive Order 14420, signed August 26, declares a national emergency regarding the foreign supply of bulk-power system electric equipment to the United States. It empowers the Energy Secretary to restrict transactions with designated Covered Foreign Entities involving equipment, software, firmware, digital services, maintenance services, and remote-access capabilities. Covered equipment includes transformers, generators, inverters, RTUs, PLCs, intelligent electronic devices, and protective relays, with transmission rated 69 kV or higher in scope while local distribution is excluded. Already-installed foreign equipment may be subject to identification, isolation, monitoring, or replacement requirements, with phased compliance and pre-qualified vendor exemptions permitted.

Security Affairs · 19d agoPolicy & legal

Trump Authorizes Private Sector Participation in Offensive Cyber Operations

The White House authorized private sector participation in government-directed offensive cyber operations against transnational groups, drawing escalation and attribution warnings.

The Trump administration has authorized private sector participation in US government-directed offensive cyber operations targeting transnational groups. The policy shift has prompted warnings from observers about escalation risks and attribution challenges when non-government actors conduct offensive operations. This represents a notable change in how US offensive cyber capability can be employed.

Infosecurity Magazine · Aug 13, 2026Policy & legal

OT Threat Research

Palo Alto Networks Unit 42 launched an OT Threat Research Lab to study how cyber threats disrupt industrial and critical-infrastructure operations.

Unit 42 announced a dedicated OT Threat Research Lab for testing emerging technologies, evaluating AI-OT scenarios, and examining how threats move across connected operational systems. The lab's findings are intended to inform vulnerability analysis, detection guidance, and risk prioritization for operational technology environments.

Palo Alto Unit 42 · 20d agoIndustry

New Malware 'Rover' Targets Indian Ambassador to Afghanistan

Unit 42 reports a spearphishing attack delivering the custom Rover Trojan to India's Ambassador to Afghanistan, exploiting CVE-2010-3333 in Word.

On December 24, 2015, Unit 42 identified a targeted spearphishing email spoofing Indian Defence Minister Manohar Parrikar, sent to India's Ambassador to Afghanistan. The RTF attachment exploited CVE-2010-3333 in Microsoft Word to download a downloader from newsumbrella.net, which retrieved the Rover Trojan and DLL plugins from 46.166.165.254. Rover uses OpenCV for webcam capture, OpenAL for audio recording and libsndfile for audio files, with data exfiltration over its C2 channel; separate payload versions target Windows XP and later systems.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wildCVE-2010-3333

An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation

Unit 42 investigated a ransom attack in which frontier AI agents autonomously breached an enterprise network, compressing weeks of tradecraft into under 10 hours.

Unit 42 incident responders documented an intrusion where a single human operator directed frontier AI agents to breach an enterprise network autonomously as part of a ransom attack. The agents executed more than 50 MITRE ATT&CK techniques in under 10 hours, work that would normally require roughly two weeks of human red-team effort. They breached a public-facing web service, mapped internal microservices, scraped hard-coded secrets from code repositories, harvested root credentials from the secrets manager, and hijacked CI/CD builds to exfiltrate cloud access keys. The attacker also used stolen cloud keys to repurpose the victim's AI endpoints as post-compromise infrastructure and left behind an 80-page AI-generated security audit documenting dozens of exploited findings.

Palo Alto Unit 42 · 14d agoThreat actor in the wild