ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “unit 42”

11 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllIndustry 15Threat actor 12Malware 11Policy & legal 10Research 8Exploit / PoC 6AI safety & security 5Phishing & fraud 5Tools 5Vulnerability 4Ransomware 1AI tools & infra 1AI industry 1Advisory 1
SeverityAllcritical 2high 19medium 20low 4info 40

FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications

Unit 42 dissects FrostyGoop OT malware, which sent Modbus TCP commands to disrupt heating for 600+ apartment buildings in Ukraine.

Palo Alto Unit 42 analyzed new FrostyGoop/BUSTLEBERM samples, the ninth known ICS-centric malware, first used against a Ukrainian municipal energy company by sending Modbus TCP commands to ENCO control devices. The attack caused a two-day heating outage affecting over 600 apartment buildings during sub-zero temperatures. The Go-compiled malware accepts Modbus register operations and timing parameters via command-line arguments or a JSON configuration file, uses an obscure open-source Modbus library, and checks the Windows BeingDebugged flag to evade debuggers. Unit 42 telemetry recorded over 1 million Modbus TCP devices exposed to the internet between September and October 2024.

Palo Alto Unit 42 · 28d agoMalware in the wild

Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.

Palo Alto Networks Unit 42 tracked a campaign as CL-CRI-1171, an infection-as-a-service platform operating for at least two years. It used 11 YouTube gaming channels with hundreds of thousands of subscribers and SEO-poisoned download pages for trojanized WinDirStat and Bluetooth driver installers to distribute OfferLoader, a disposable loader embedded in Inno Setup installers. Payloads delivered included Insomnia RAT (Node.js and Python backdoors), ARKTunnel (a WebSocket-based RAT using LSB steganography), and Docro Hijacker (Chrome browser hijacker), with later infections delivering GCleaner and Socks5Systemz. Over 200 rotating domains across .xyz, .cfd, .space, and .info TLDs were used, with gating filters that served broken links or decoy pages to scanners and researchers.

GBHackers · 5d agoMalware in the wild2

Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

Unit 42 exposes CL-CRI-1171, a pay-per-install network spreading malware like Insomnia RAT via YouTube channels and SEO poisoning for over two years.

Palo Alto Networks Unit 42 details CL-CRI-1171, a cybercrime cluster operating a pay-per-install (PPI) marketplace that has delivered multiple malware families for at least two years. The group used at least eleven YouTube gaming channels with hundreds of thousands of followers, plus SEO poisoning promoting trojanized software such as a Bluetooth driver and WinDirStat, infecting gamers and corporate endpoints including critical infrastructure and government entities. A single shared loader delivered payloads including Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner and Socks5Systemz between July 2025 and April 2026, with more than 10,000 distinct loader samples and over 200 rotating C2 domains identified. YouTube terminated the malicious channels after Unit 42 notified the platform.

Palo Alto Unit 42 · 7d agoMalware in the wild1

Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self

Unit 42 uncovered Eleethub, a Perl-based Bitcoin mining botnet using a crafted rootkit and libprocesshider to evade detection, still under development with few infections.

Unit 42 discovered an under-development Perl Shellbot campaign that mines Bitcoin using xmrig and emech while evading detection via a rootkit that replaces the ps tool and the LD_PRELOAD-based libprocesshider.so library. Infected devices download a malicious shell script, connect to IRC-based C2 at eleethub.com and the UnderNet network, and can receive commands for UDP/TCP floods, port scans, and HTTP attacks. The botnet can affect Unix systems and Windows 10 hosts running a Linux subsystem, and its operators use the 'Los Zetas' branding, though they are unlikely to be the Mexican drug cartel. Researchers found only a few compromised 'zombies' before the campaign expanded.

Palo Alto Unit 42 · 28d agoMalware in the wild

Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices

Unit 42 found a Muhstik botnet variant brute-forcing Tomato router web authentication to harvest IoT devices for crypto mining and DDoS attacks.

Palo Alto Networks Unit 42 researchers in December 2019 identified a new Muhstik botnet variant scanning Tomato routers on TCP 8080 and brute-forcing default admin credentials, targeting roughly 4,600 exposed devices found via Shodan. The variant also scans WordPress and Webuzo installations and exploits the Oracle WebLogic deserialization flaw CVE-2019-2725 for unauthenticated remote code execution. Muhstik, active since March 2018, self-propagates like a worm and typically monetizes infections through cryptocurrency mining and DDoS attacks controlled via an IRC C2 channel.

Palo Alto Unit 42 · 28d agoMalware in the wildCVE-2019-2725

Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker

Unit 42 exposed CL-CRI-1171, a pay-per-install operation using YouTube gaming channels and SEO poisoning to deliver RATs and a Chrome hijacker.

Palo Alto Networks Unit 42 identified over 10,000 OfferLoader samples and 11 YouTube channels pushing trojanized installers via gaming lures and SEO-poisoned searches for tools like WinDirStat and Bluetooth drivers. Trojanized Inno Setup installers spawn three payload branches: Insomnia RAT (dual Node.js/Python backdoor that disables Microsoft Defender), ARKTunnel (undocumented RAT hiding its payload in a bitmap image and tunneling TCP/UDP), and Docro Hijacker (alters Chrome protected preferences to hijack search and affiliate links). The pay-per-install model sells each infection to multiple buyers, reaching gamers as well as corporate and government endpoints.

Cyber Security News · 3d agoMalware in the wild1

TuxBot v3: Inside an IoT Botnet Framework With LLM

Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.

Palo Alto Unit 42 identified TuxBot v3 Evolution, a modular IoT botnet framework derived from AISURU, Wuhan-lineage botnets, and MHDDoS. The C-based bot brute-forces Telnet with 1,496 credential pairs, targets over 30 IoT device families, and communicates with a Go-based C2 over encrypted TCP with multiple fallback mechanisms including DGA, P2P, and DNS TXT. LLM-assisted development left hallucinated crypto implementations and broken exploit modules in the analyzed samples, though roughly 70% of core functionality works. Researchers warn polished production builds likely exist, raising the threat potential.

Palo Alto Unit 42 · 28d agoMalware1

Atomic macOS (AMOS) Stealer Activity

Unit 42 details an August 2026 AMOS macOS stealer infection delivered via fake 'macOS toolkit' pages and Terminal paste commands, exfiltrating credentials to C2.

Unit 42 analyzed an AMOS (Atomic macOS Stealer) infection from August 5, 2026, initiated via a page at getmacouscloud[.]com instructing users to paste a command into Terminal. The command fetched a Zsh script from ferncore13[.]com that delivered a Mach-O installer to /tmp/helper and supporting files under /Library/Application Support/.com.apple.accountsd/ and .com.apple.metadata.mds/. AMOS collected browser data, credentials, cryptocurrency wallets (Binance, TonKeeper), Telegram data, and FileGrabber content such as AWS and gcloud files, uploading it via HTTP POST to C2 server 161.35.146[.]120. AMOS has been advertised on Telegram since April 2024 and distributed via ClickFix campaigns, malicious ads, and cracked-software sites.

Palo Alto Unit 42 · 22h agoMalware in the wild

ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories

Weekly ThreatsDay bulletin details a ShinyHunters-style social engineering hit on ReliaQuest, the 296,000-device Dysphoria IoT botnet, and several new malware families.

ReliaQuest confirmed a social engineering attack on August 22, 2026, in which an attacker used a fake SSO page and MFA push approval to gain brief view-only access to an identity dashboard, with tactics matching ShinyHunters, which has since listed the firm on its leak portal. The Shadowserver Foundation reported the Dysphoria botnet has compromised nearly 296,000 IoT devices for DDoS attacks and recently added residential proxy capability. Cisco Talos documented JWR, an operator-driven phishing-as-a-service framework linked to The Outsider that harvests credentials, identity documents, and 2FA codes over an encrypted WebSocket. New malware coverage includes the Octagon Android fraud bot ($1,400/month), the C2Looper Rust backdoor delivered via ClickFix, and the Aeternum loader that moved C2 to the Polygon blockchain.

The Hacker News · 15d agoMalware in the wild

New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode

A new Windows backdoor dubbed SLEEPWALKER hides as ESET Management Agent's dpapi.dll, waits for a crafted network packet, then executes custom 23-instruction bytecode.

Researcher Dominik Reichel documented SLEEPWALKER, an unsigned 59,904-byte 64-bit Windows DLL that side-loads into ESET Management Agent's ERAAgent.exe while impersonating dpapi.dll. The implant monitors every network interface indefinitely for a specifically crafted trigger packet, then executes commands written in a custom 23-instruction bytecode language over six transports, including TCP, UDP, ICMP, SMB named pipes, raw promiscuous capture, and VMware VMCI. It has no embedded infrastructure, makes no outbound connections of its own, and requires prior local administrator access to install; no victims, attribution, or in-the-wild deployment are confirmed. Reichel assesses the design as consistent with a targeted, well-resourced operation, while ESET calls the scenario's security relevance negligible since it provides no new access path.

The Hacker News · 13d agoMalware1

Dogged Russia-based botnet dismantled after 23-year run

Law enforcement, CrowdStrike and Shadowserver dismantled the 23-year-old Sality P2P botnet that infected more than 11 million devices.

Sality, a Russia-based peer-to-peer botnet active for 23 years and infecting over 11 million devices, was dismantled by law enforcement working with CrowdStrike and the Shadowserver Foundation. CrowdStrike poisoned the botnet's peer list so infected machines permanently disappeared from the operator's view, while domains were seized in a coordinated effort involving the FBI, Justice Department, Europol and authorities from Bulgaria, Hungary and Romania. The financially motivated operation enabled cryptocurrency theft, DDoS attacks and other cyberattacks, and Europol said the effort dates back to 2017; the operators were not named.

CyberScoop · 14d agoMalware