Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
Palo Alto Networks positions Cortex XSIAM as a purpose-built platform to simplify security operations and speed incident remediation.
The Unit 42 blog page is a product category archive for Cortex XSIAM. The platform is marketed as purpose-built for SecOps transformation, simplifying security operations and accelerating incident remediation against current and future threats. No research findings, incidents, or vulnerabilities are discussed.
Palo Alto Networks Unit 42 hosts content under its Cortex XSOAR category, covering the vendor's security orchestration, automation and response platform.
The item is a Unit 42 category page for Cortex XSOAR rather than a standalone article; no article text was available. Cortex XSOAR is Palo Alto Networks' security orchestration, automation and response (SOAR) platform used for incident management and playbooks. No incident, vulnerability, or research findings could be extracted from the available information.
Palo Alto Unit 42 Cortex Xpanse product-category page published with no article text available for classification.
The URL resolves to the Cortex Xpanse product category listing on the Unit 42 blog rather than a research article. No article body was provided, so no vulnerabilities, incidents, or research findings can be extracted.
Stub page for Palo Alto Cortex XDR with no article text, offering no news content for classification.
The item contains only the title 'cortex xdr' and no article body. It references Palo Alto Networks' Cortex XDR product but provides no event, release, or threat information. Classified as general vendor/industry content with minimal relevance.
Unit 42 assesses Ryuk ransomware amid a CISA/FBI/HHS alert on threats to U.S. healthcare, including the UHS attack that disrupted hospital operations.
A joint CISA, FBI, and HHS alert on October 28, 2020 warned of an imminent threat to U.S. healthcare from operators deploying Trickbot and Ryuk ransomware. Universal Health Services reported a Ryuk attack that disrupted all U.S. UHS sites for weeks, with similar incidents at hospitals in Oregon and New York. Ryuk typically arrives after Trickbot or BazaLoader infections delivered via malicious email, and operators enumerate networks with PowerShell and WMI before encryption. The Trickbot Anchor_DNS module performs DNS tunneling for C2, using connectivity checks to benign domains like ipinfo.io and checkip.amazonaws.com.
Unit 42 details active exploitation of Exchange SSRF flaws CVE-2022-41080/CVE-2022-41082 via the OWASSRF method, deploying the SilverArrow PowerShell backdoor.
Unit 42 documents OWASSRF, an exploit chain combining CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution on Microsoft Exchange via Outlook Web Access, bypassing Microsoft's ProxyNotShell mitigations. Active exploitation was observed in late November and early December 2022, affecting at least eight organizations. Attackers authenticated to Exchange, then executed a PowerShell backdoor tracked as SilverArrow to create admin accounts, install AnyDesk, tunnel RDP via PuTTY Link, and dump LSASS memory for credential theft. Exploitation is isolated rather than mass-scale because authentication is required.
Unauthenticated Confluence RCE CVE-2022-26134 was exploited in the wild; Volexity observed intrusions and Cerber ransomware on unpatched servers.
Volexity identified exploitation of CVE-2022-26134, an unauthenticated remote code execution vulnerability in Atlassian Confluence Server and Data Center, during Memorial Day weekend 2022, with Atlassian issuing a patch. Cortex Xpanse found 19,707 potentially affected Confluence instances, concentrated in the US, Germany, China, and Russia, plus 1,251 end-of-life versions exposed. Unit 42 and Cortex Managed Threat Hunting observed successful exploitation leading to reconnaissance commands and a Cerber ransomware deployment that was blocked by Cortex XDR. A public PoC has increased exploitation risk.
Researchers introduced Brain2Semantics2Text, decoding sentence meaning from non-invasive MEG brain recordings via a semantic bottleneck, improving on prior Brain2Text methods.
The paper proposes Brain2Semantics2Text, a non-invasive speech decoding method that maps sentence-level magnetoencephalography (MEG) responses into a semantic embedding space and inverts those embeddings into natural language. Motivated by evidence that high-level semantic representations are distributed across cortex and evolve on slower timescales, the approach targets meaning rather than phonemes or words, avoiding the need for word-level alignment. The authors report improved sentence-level results compared to prior non-invasive Brain2Text methods despite the low signal-to-noise ratio of neural recordings.
Unit 42 details five vulnerabilities (CVSS 7.0-7.8) in ICONICS Suite SCADA software enabling privilege escalation and DoS.
Unit 42 discovered five vulnerabilities (CVE-2024-1182, CVE-2024-7587, CVE-2024-8299, CVE-2024-8300, CVE-2024-9852) in ICONICS Suite versions 10.97.2 and earlier for Windows during a 2024 security assessment. The flaws, rated CVSS 7.0-7.8, allow DLL hijacking, privilege escalation, information disclosure, denial-of-service and potentially full system compromise. ICONICS Suite is a SCADA solution with hundreds of thousands of installations in over 100 countries, widely used in critical infrastructure, and several dozen servers are internet-exposed per Unit 42 telemetry. ICONICS released patches and advisories with workarounds in 2024.
Palo Alto Networks publishes a product category page for Cortex Cloud, an AI and automation platform for cloud and SOC workflows.
This item is a product category archive page for Palo Alto Networks' Cortex Cloud, describing it as an AI and automation-driven platform spanning code to cloud to SOC. The page contains no new research, incident, or product release details beyond marketing language about prioritizing risks and accelerating remediation.
Alloy Taurus (GALLIUM) compromised Southeast Asian government networks from 2022 to 2023 using Exchange web shells and undocumented .NET backdoors Reshell and Zapoa.
Unit 42 tracked persistent multiwave intrusions at a Southeast Asian government starting in early 2022 and continuing through 2023, attributing the activity with moderate confidence to Alloy Taurus (aka GALLIUM), a Chinese state-aligned espionage group. Attackers exploited Exchange Server vulnerabilities to deploy web shells including China Chopper, then ran reconnaissance with Fscan and WebScan, created administrative accounts, and installed undocumented .NET backdoors named Reshell and Zapoa. They established resilience by installing SoftEther VPN, brute-forced Active Directory credentials with Kerbrute, and dumped credential stores with GoDumpLsass and LsassUnhooker. The campaign reflects long-term espionage tradecraft to maintain a foothold.
Study of label leakage and anatomical grounding in multimodal MRI models for Alzheimer's staging shows cognitive-score fusion accuracy of 87.3% is leakage-driven.
The authors train a ResNet18 slice-based encoder with a one-layer Transformer on 1,075 ADNI-1 T1 MRI scans, using FastSurfer segmentations and YOLOv8 localization (mAP_50 above 0.96) as anatomical reference. Grad-CAM shows the image-only classifier often attends to skull and background rather than disease-relevant structures. A CLIP-style image-tabular contrastive framework organized along a label-leakage spectrum yields 87.3% three-way accuracy with cognitive scores versus 73.0% with regional volumes, and cropping to the medial temporal lobe raises image-only accuracy from 58.7% to 65.1%. Results come from single runs on a small balanced test set with reported confidence intervals.
RenderFormer-V2 is a transformer-based neural renderer handling caustics, volumetric scattering and out-of-distribution materials without per-scene training or specialized code.
RenderFormer-V2 is a learned transformer-based neural rendering model that models global light transport as a sequence-to-sequence transformation, handling caustics, volumetric scattering, environment lighting, textured and displaced surfaces and out-of-distribution materials. It uses a two-stage process: a view-independent stage resolving primitive-to-primitive transport, and a view-dependent stage converting the neural scene representation into pixels. Improvements include combined windowed-attention with a rendering-informed attention sink for scalability, support for heterogeneous primitives like environment maps and participating media, and a surface-reflectance-independent neural material encoding, validated across diverse scenes with extensive ablations.
Theoretical tutorial establishes equivalence between covariance neural networks and PCA, with stability and transferability bounds and brain-age applications.
The paper reviews the theory of coVariance neural networks (VNNs), graph neural networks that operate on covariance matrices as graphs. It derives a conceptual equivalence between VNNs and PCA-based information processing, refined stability bounds under finite-sample covariance perturbations, and transferability characterizations across multiscale datasets. Demonstrated applications include brain age gap estimation for neurodegenerative conditions from neuroimaging data.
Attackers actively exploit Spring Framework RCE CVE-2022-22965 (SpringShell, CVSS 9.8) to deploy webshells; patches 5.3.18/5.2.20 shipped March 31, 2022.
CVE-2022-22965 enables unauthenticated remote code execution in the widely used Spring Framework (CVSS 9.8), which Unit 42 has observed being exploited in the wild. The flaw stems from getCachedIntrospectionResults exposing the class object during parameter binding, letting attackers manipulate the class loader to modify Tomcat logging and upload a JSP webshell. Public PoCs require JDK 9+, Tomcat, WAR packaging, and spring-webmvc or spring-webflux dependencies on Spring 5.3.0-5.3.17, 5.2.0-5.2.19, or older. Fixes shipped in Spring Framework 5.3.18 and 5.2.20; the related Spring Cloud Function flaw CVE-2022-22963 was patched March 29, 2022.
Buyer's guide compares 12 XDR platforms, favoring Microsoft Defender XDR, Stellar Cyber and CrowdStrike, and warns ingestion pricing inflates costs.
The article compares 12 extended detection and response platforms, distinguishing native XDR (CrowdStrike, Palo Alto Cortex XDR, Microsoft Defender XDR, SentinelOne) from open XDR (Stellar Cyber, Arctic Wolf, Rapid7). It argues data ingestion pricing, not per-endpoint fees, is the main budget risk and should be modeled before signing. It repeats the consolidation note that Sophos acquired Secureworks for approximately $859 million in February 2025, and flags that ExtraHop is NDR rather than full XDR.
The 2026 PNPL competition releases LibriBrain100, a MEG speech dataset with 32 extra subjects, targeting word classification and cross-subject BCI generalization.
The 2025 PNPL competition on non-invasive speech decoding from MEG achieved F1-macro scores of 95.6% for speech detection and 73.6% for phoneme classification, built on LibriBrain's ~50 hours of single-subject data. The 2026 edition extends this with LibriBrain100, adding 32 subjects (~40 minutes each) plus ~80 hours of within-subject data. Two tracks target within-subject word classification at scale and cross-subject generalization with subject-specific fine-tuning shrinking from ~40 to ~20 to ~10 minutes, aiming at clinically feasible non-invasive BCIs for people with profound paralysis.
Unit 42 dissects FrostyGoop OT malware, which sent Modbus TCP commands to disrupt heating for 600+ apartment buildings in Ukraine.
Palo Alto Unit 42 analyzed new FrostyGoop/BUSTLEBERM samples, the ninth known ICS-centric malware, first used against a Ukrainian municipal energy company by sending Modbus TCP commands to ENCO control devices. The attack caused a two-day heating outage affecting over 600 apartment buildings during sub-zero temperatures. The Go-compiled malware accepts Modbus register operations and timing parameters via command-line arguments or a JSON configuration file, uses an obscure open-source Modbus library, and checks the Windows BeingDebugged flag to evade debuggers. Unit 42 telemetry recorded over 1 million Modbus TCP devices exposed to the internet between September and October 2024.
ReactHuman benchmark tests whether multimodal LLMs react safely to sudden household hazards; seven evaluated models mishandle roughly one hazard in three.
ReactHuman is the first physics-grounded benchmark for human-like reactive decision-making, placing a multimodal LLM as the brain of a simulated humanoid facing 17 event families of sudden household hazards across over 1,000 bit-for-bit reproducible scenes with annotation-free ground truth from 240 Hz rigid-body simulation, including adversarial objects whose appearance contradicts their physics. A five-metric suite scores each reaction along reasonable, safe, and physically grounded axes, and every committed plan is physically executed. Seven representative MLLMs mishandle roughly one hazard in three, act from fixed dispositions rather than the observed scene, trust appearance over motion, and miss interception points at meter scale; none of these failures shrink with model scale.
Unit 42 clusters behavior of 40,000+ AWS identities from 125 cloud environments to map functional roles and enable lightweight SQL-based detection.
Palo Alto Unit 42 built an unsupervised behavioral clustering model using UMAP and HDBSCAN on AWS CloudTrail logs to map cloud identities to functional roles such as administrators, backup services, security tooling and DevOps. The study analyzed over 40,000 identities across 125 cloud environments over two months. The researchers show that heuristics extracted from the clustering map can be implemented in standard SQL, enabling role classification at scale without running a continuous ML pipeline. The methodology extends to audit logs from other cloud providers, SaaS and Kubernetes.
CodeTD detects hallucinations in code LLMs before execution by analyzing topological patterns of attention maps, outperforming recent baselines.
CodeTD applies topological data analysis (TDA) to code LLM attention maps to quantify prompt-generation mismatch as a pre-execution correctness signal. Experiments cover HumanEval, MBPP, BigCodeBench, and MultiPL-E across 5 programming languages and 10 code LLMs up to 34B parameters. The method outperforms recent baselines and transfers between coding benchmarks, helping catch code that fails the task or embeds security vulnerabilities.
An editorial scorecard ranks 12 EDR platforms, with CrowdStrike and SentinelOne tied at 8.6/10 and telemetry retention identified as the hidden cost driver.
An editorial comparison scores twelve EDR platforms on detection, response, analyst burden, pricing transparency, and coverage. CrowdStrike and SentinelOne tie at 8.6/10, with Microsoft Defender for Endpoint close behind at 8.5 and described as effectively free in Microsoft 365 E5 estates. The guide argues that telemetry retention, not per-endpoint price, drives real cost, with fully-priced quotes frequently diverging 2-3x from headline rates. Managed detection offerings, including Cynet's bundled 24/7 SOC, factor into the buyer-fit rankings.
Researchers release Gander, an end-to-end omni interaction model with full-duplex streaming across video, speech, and text plus agentic capabilities.
Gander is an end-to-end model unifying omni perception, realtime interaction, and agentic capabilities in a single framework, accepting continuously streaming video, speech, and text. It uses a Cerebellum-Brain architecture where the Cerebellum handles realtime conversation and the Brain handles reasoning and agentic tasks, built on a streaming Thinker-Talker design with chunk-level token streams. Internal human evaluations report spoken dialogue on par with SOTA open source models and competitive omni interaction; the models, code, and data are released publicly.
Trojanized 3CXDesktopApp installers for Windows and macOS loaded RC4-encrypted shellcode delivering a backdoor to hundreds of thousands of 3CX users.
Threat actors compromised the 3CXDesktopApp build process, adding malicious libraries (ffmpeg.dll, d3dcompiler_47.dll) to installers downloaded from the developer's website. The Windows MSI loader decrypts embedded shellcode with RC4, sleeps for a random 1-4 weeks, then beacons to C2 hidden in icon files on GitHub. Unit 42 fingerprinted 247,277 IPs across 199 countries using 3CX applications and blocked shellcode execution at 127 Cortex XDR customers between March 9-30, 2023.
OracleZoom enables recursive extreme-scale image super-resolution via reference-constrained on-policy distillation, reducing hallucinations at deep zoom scales.
OracleZoom tackles recursive super-resolution, where repeated feeding of predictions back into the same model leaves deeper-scale outputs unsupervised as required source resolution grows geometrically. The framework trains on its own trajectory while carrying the last ground-truth evidence beyond the supervision boundary, combining direct and cross-scale supervision, a no-reference quality objective, a KL-constrained pretrained latent prior, and EMA consistency. Across seven datasets it achieves state-of-the-art SR quality across zoom scales, averaging 0.713 CLIPIQA with larger gains at deeper scales and significantly reduced hallucinations. Code, data, and models are publicly released.
TrickBot phishing campaign used SendGrid, fake Google Docs, and Drive-hosted downloaders disguised as Word files to deliver a credential-stealing payload.
Unit 42 identified a TrickBot distribution campaign on November 7-8, 2019, using payroll and annual bonus-themed emails sent from likely compromised .edu addresses through the legitimate SendGrid email delivery service. Emails contained links to Google Docs documents linking to downloader executables hosted on Google Drive, further masked behind SendGrid click-tracking URLs. The downloaders, signed by PERISMOUNT LIMITED and displayed with Microsoft Word icons, show a decoy pop-up and retrieve TrickBot payloads from compromised legitimate domains such as savute[.]in and lindaspryinteriordesign[.]com. The newer TrickBot variant stores its files and configuration under %APPDATA%\cashcore.
Probing finds transformers represent an inferred dialogue partner's expertise in early layers long before it causally influences output.
Using ExpertCollab, a corpus of multi-turn research-planning dialogues between model-played personas at four expertise levels, researchers show that a partner's inferred expertise is most decodable in early transformer layers and decays to near chance before the network's midpoint. Counterfactual patching reveals that injecting the expertise difference at peak decodability barely changes a fixed late-layer readout, while injection past the midpoint propagates almost completely. The result bounds where readout or steering of partner-conditioned behavior must intervene, demonstrated on a single model with a synthetic corpus.
Unit 42 links Stately Taurus APT activity in ASEAN region and Myanmar to the decade-old Bookworm malware family via infrastructure overlaps.
Unit 42 connected Stately Taurus (aka Mustang Panda) espionage activity targeting ASEAN-affiliated organizations and Myanmar to the Bookworm malware family, first published in 2015. Earlier attacks delivered the PubLoad stager via DLL sideloading, with a PubLoad variant communicating with C2 at 123.253.32[.]15 while mimicking Windows Update URLs. Three previously unreported loader samples from 2021-2022 used UUID-decoded shellcode loaded via heap allocation and API callbacks, ultimately decrypting and loading Bookworm DLLs. A ToneShell backdoor variant shared debug paths with Bookworm loaders, and the January 2024 CSIRT CTI post corroborated the Myanmar attacks.
Researchers characterize NERVE, five attack dimensions against AI-powered brain-computer interfaces, and release the EEGle framework uncovering 17 attack instances.
NERVE is a systematic attack class spanning the BCI stack across five orthogonal dimensions: Neuro-mimetic Forgery, Evasion via Desynchronization, Replay-based Hijacking, Vein Tapping, and Embedded Backdoors. The accompanying EEGle framework enables AI-assisted, extensible BCI security analysis and helped uncover 17 novel neuro-specific attack instances, revealing a stealth-effectiveness spectrum unique to BCI backdoor design. The authors show generative AI lowers the barrier to entry for non-expert attackers and release EEGle to the community.
Unit 42's AI-powered tool found 15 BOLA vulnerabilities in Easy!Appointments, rated up to CVSS 9.9, letting low-privileged users escalate privileges; fixed in 1.5.0.
Unit 42's automated BOLA detection tool, built on generative AI, uncovered 15 broken object-level authorization flaws in the open-source scheduling application Easy!Appointments, tracked as CVE-2023-3285 through CVE-2023-3290 and CVE-2023-38047 through CVE-2023-38055. Nine flaws scored CVSS 9.9, letting logged-in customers view or manipulate appointments and accounts of providers and admins, including creating admin users for privilege escalation. The maintainers patched all issues in version 1.5.0. The same tool previously found a BOLA in Grafana (CVE-2024-1313).
Panel is an open-source research workspace where AI agents dynamically build their own panes, posted on Hacker News.
Panel, shared as a Show HN project on GitHub, is a research workspace in which the agent can construct its own panes rather than using a fixed interface. The post received 41 points and 8 comments on Hacker News. It targets agentic research workflows with a dynamically generated UI.
Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.
Palo Alto Unit 42 details BOLABuster, a methodology combining large language models with heuristics to automate detection of broken object-level authorization (BOLA) flaws, which traditional fuzzing and static analysis struggle to find. The approach uses LLM reasoning to understand application logic, map endpoint dependency relationships, and generate and interpret test cases. It found CVE-2024-1313 in Grafana, CVE-2024-22278 in Harbor, and 15 CVEs in Easy!Appointments. The team is continuing to hunt for BOLAs in open-source and internal projects.
Case study applies Gaussian and Laplace differential privacy to clinical EEG features, quantifying privacy-utility trade-offs across three deployment scenarios.
Researchers evaluate subject-level differential privacy for EEG-derived feature representations using Gaussian and Laplace perturbations across client-side, centralized server-side, and decentralized local training scenarios. Utility is assessed with statistical measures and a downstream machine-learning check on clinical neurophysiology data. Results show DP can be integrated into EEG workflows, but mechanism choice, privacy parameters, and sensitivity calibration strongly influence data utility, particularly on small and imbalanced clinical datasets. The study highlights the privacy-utility trade-off in protecting biomedical signals against re-identification and inference risks.
Unit 42 uncovers ApateWeb, a campaign using over 130,000 domains and multilayered redirects to deliver scareware, adware and PUPs to millions of users.
Unit 42 discovered ApateWeb, a large-scale campaign using a network of more than 130,000 domains to deliver scareware, potentially unwanted programs, adware including a rogue browser and browser extensions, and scam pages. The campaign uses a three-layer structure with deceptive emails as the entry point, centralized victim tracking via UUIDs, intermediate adware or anti-bot redirections, and evasion tactics such as cloaking, bot detection error pages, and wildcard DNS abuse. Activity spiked since August 2022, with several hundred attacker-controlled sites remaining in Tranco's top 1 million rankings and millions of monthly hits; Unit 42 blocked an estimated 3.5 million sessions across 74,711 devices in November 2023.
CoRA-NAS combines zero-cost proxy ranking with low-cost learning-curve refinement, achieving the best worst-space Spearman correlation across NAS benchmarks.
The paper proposes CoRA-NAS, a two-stage neural architecture search framework pairing a static ranking prior (CoRA-Rank) with learning-curve refinement (CoRA-Refine) that extrapolates early validation curves for sampled anchors and propagates residual corrections with an ExtraTrees model at about 1% of full training cost. Across NAS-Bench-201, NAS-Bench-101, TransNAS-Bench-101, and NATS-SSS it achieves mean Spearman correlations of 0.946, 0.715, 0.786, and 0.894 respectively, with the best worst-space correlation of 0.715 among compared methods. On NAS-Bench-201/CIFAR-100 its selected architecture reaches 73.32% accuracy versus a 73.37% ground-truth best.
Unit 42 maps attack paths into AWS, Azure, and GCP VMs through intended features like startup scripts and SSH key pushes.
Palo Alto Unit 42 reviewed attack vectors against virtual machine services on AWS, Azure, and GCP, finding that 11% of internet-exposed cloud hosts carry Critical or High severity vulnerabilities. The attack paths rely on legitimate features such as EC2 User Data, VM custom data, EC2 Instance Connect, SSM Run Command, and serial consoles rather than vulnerabilities, and exploiting them requires attackers to first obtain control plane permissions. A compromised VM exposes not only its data but the workload identity and cloud permissions assigned to it, making identity compromise potentially more damaging than data theft. The firm places mitigation responsibility on cloud users and administrators.
Evaluation of 2-8B VLMs (Qwen3-VL, Gemma3) against BioCLIP on camera-trap species ID shows all models degrade sharply on field imagery.
The study tests whether edge-deployable 2-8B vision-language models carry genuine taxonomic knowledge, comparing Qwen3-VL 2B/4B/8B and Gemma3 4B against the 300M specialist BioCLIP on a 96-species task across clean iNaturalist photos and six LILA.science camera-trap collections. All models degrade 9.6-26.6 percentage points on field imagery, and BioCLIP outperforms every VLM by 33.2-59.2 points on an expanded 200-image sample, suggesting specialized data rather than scale drives the gap. Under open-set prompting, 5.9-9.6% of responses are syntactically valid but taxonomically nonexistent species names, with fabrication rankings replicating across evaluation sets.
Unit 42 analysis of 4 million malware reports finds 45% of C2-active samples connect directly to hard-coded IPs, bypassing DNS defenses.
Palo Alto Unit 42 analyzed over 4 million Advanced WildFire dynamic analysis reports and found that 45.32% of malware samples with C2 activity made at least one direct-to-IP connection, accounting for 23.17% of all C2 connection attempts. The firm proposes zero trust IP (ZT-IP), an enforcement approach that verifies whether outbound destinations were ever sanctioned by a DNS response. ZT-IP analysis surfaced Phorpiex ransomware droppers fetching payloads directly from C2 IPs, a persistent data exfiltration campaign using an obfuscated \GET protocol, and Mozi P2P botnet payloads delivered to IoT devices without DNS. Only 1% of benign samples connected directly to untrusted IP addresses.
Domain-adversarial nnU-Net trained on 4,604 CT/MRI scans achieves 87.31% Dice pancreas segmentation with label-efficient subregion transfer.
A unified 3D pancreas segmentation framework applies domain-adversarial learning to 4,604 heterogeneous CT and MRI scans, aligning CT-MRI features via a latent domain discriminator on a shared nnU-Net encoder-decoder. Whole-pancreas segmentation reaches 87.31% Dice in-distribution and 84.20%-88.09% across external OOD datasets. The transferred encoder achieves 80.53% Dice on MRI and 83.05% on CT for downstream head-body-tail subregion segmentation using only limited MRI subregion annotations.
Unit 42 found a new Mispadu infostealer variant targeting Mexican users via malicious .url files exploiting the SmartScreen CVE-2023-36025 bypass.
Unit 42 discovered a new variant of Mispadu Stealer, a Delphi-based banking trojan first reported in 2019, found while hunting for the Windows SmartScreen bypass CVE-2023-36025. The campaign uses crafted .url files referencing UNC network-share paths with an HTTP port (@80) that forces payload retrieval over WebDAV via rundll32.exe, avoiding SmartScreen warnings. Analyzed samples (~4 KB, compiled 2023-11-12) predate the CVE publication, and ZIP payloads were likely distributed as email attachments, primarily targeting users in Mexico.