ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “container”

15 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 842Vulnerability 597Ransomware 285Malware 222Data breach 185Threat actor 148Phishing & fraud 78Policy & legal 75AI safety & security 27Advisory 18Research 5Industry 3AI tools & infra 1Model release 1
SeverityAllcritical 1865high 447medium 151low 15info 10

Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)

SANS guest analyst detonated a RedTail Linux sample from a DShield honeypot, finding process masquerading as php-fpm, monitoring-kill behavior, and a TCP listener.

A DShield honeypot captured multi-architecture RedTail Linux executables (ARM, ARM64, i686, RISC-V, x86-64) deployed via shell scripts. Dynamic analysis of the UPX-packed, statically linked x86-64 sample (SHA-256 63be5f38...d35e) in an isolated Ubuntu 24.04 VM on Proxmox showed it renamed its process via prctl(PR_SET_NAME), killed a filesystem-monitoring process, and opened a TCP listening socket while surviving processes posed as php-fpm or PostgreSQL-like workers. Differential memory images pre- and post-execution were captured from the hypervisor for forensics.

SANS Internet Storm Center · 6d agoMalware in the wild1

Scam Attacks Taking Advantage of the Popularity of the Generative AI Wave

Unit 42 finds about 225 generative AI-themed domains registered daily since ChatGPT's launch, with nearly 29 percent suspicious, fueling scams and PUP delivery.

Palo Alto Networks analyzed new domain registrations containing generative AI keywords such as chatgpt, prompt, and sora since ChatGPT's November 2022 launch, observing around 225 GenAI-related registrations per day. About 28.75 percent of these domains are suspicious, a rate 22 times higher than for general new domains, with registration spikes aligning with milestones like Bing ChatGPT integration, the GPT-4 release, new GPTs, and OpenAI's Sora announcement. Over 72 percent of the domains use gpt or chatgpt keywords, and gpt domains show a 76 percent suspicious rate. Case studies cover PUP delivery, spam distribution, and monetized domain parking, with 35 percent of traffic to these domains directed at suspicious ones.

Palo Alto Unit 42 · Aug 17, 2026Phishing & fraud in the wild1

Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices

Unit 42 found a Muhstik botnet variant brute-forcing Tomato router web authentication to harvest IoT devices for crypto mining and DDoS attacks.

Palo Alto Networks Unit 42 researchers in December 2019 identified a new Muhstik botnet variant scanning Tomato routers on TCP 8080 and brute-forcing default admin credentials, targeting roughly 4,600 exposed devices found via Shodan. The variant also scans WordPress and Webuzo installations and exploits the Oracle WebLogic deserialization flaw CVE-2019-2725 for unauthenticated remote code execution. Muhstik, active since March 2018, self-propagates like a worm and typically monetizes infections through cryptocurrency mining and DDoS attacks controlled via an IRC C2 channel.

Palo Alto Unit 42 · 28d agoMalware in the wildCVE-2019-2725

Network Abuses Leveraging High-Profile Events: Suspicious Domain Registrations and Other Scams

Unit 42 found scammers surge deceptive domain registrations around major events like the 2024 Paris Olympics to run phishing and counterfeit merchandise scams.

Unit 42 analyzed newly registered domains (over 200,000 detected daily from zone files, WHOIS, and passive DNS) containing event-specific keywords, using the 2024 Paris Summer Olympics as a case study. Threat actors register lookalike domains to sell counterfeit merchandise, push fraudulent services, and run phishing, as previously seen with COVID-19-themed and fake ChatGPT tool scams. The article recommends monitoring domain registrations, DNS and URL traffic trends, textual patterns, and verdict change requests to catch event-themed abuse early.

Palo Alto Unit 42 · Aug 17, 2026Phishing & fraud in the wild

"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware

Unit 42 profiles the Blank Slate malspam campaign: blank emails with double-zipped attachments delivering Cerber ransomware while cycling abused hosting provider domains.

The Blank Slate campaign sends empty emails containing double-zipped archives with macro-enabled Word documents or JavaScript files that launch PowerShell to download ransomware, primarily Cerber, and occasionally Sage 2.0 or Locky. Unit 42 observed 555 campaign domains over seven months, with actors repeatedly registering new domains and cycling abuse of legitimate hosting providers after takedowns. In a five-day January-February 2017 window, at least eight domains across seven IP addresses were observed hosting Cerber payloads.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild1

Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics

Unit 42 tracks the new Mole ransomware (CryptoMix family) spread via USPS-themed malspam, with tactics escalating to JavaScript downloaders dropping multiple malware families.

On April 11, 2017, a malspam campaign began distributing Mole ransomware, a CryptoMix-family strain, through USPS-themed emails linking to fake Microsoft Word Online sites offering a bogus Office plugin. By April 13 the campaign added Nemucod JavaScript downloaders installing Mole alongside Kovter and Miuref, and by April 18 it switched to the KINS banking Trojan before moving to speeding-ticket themes and a fake parking services website. Unit 42 notes the rapid tactic changes are likely intended to evade detection, and CryptoMix variants like Mole are typically repackaged within weeks.

Palo Alto Unit 42 · Aug 17, 2026Ransomware in the wild

Malspam Targeting Brazil Continues to Evolve

Brazilian malspam campaigns continue evolving, abusing Google URL shortener and Dropbox and using Squiblydoo plus DLL side-loading to deploy likely infostealing botnet malware.

A June 2017 Brazilian malspam campaign spoofed IPTU tax notification emails, using the recipient's address as the sender, and abused Google's URL shortener and Dropbox to deliver a zip containing a malicious Windows shortcut (.lnk) file. The LNK used the Squiblydoo technique (regsvr32.exe) to download and execute a scriptlet with elevated privileges, retrieving a signed G-Buster Browser Defense executable alongside a malicious fltLib.dll loaded via side-loading, likely an information-stealing botnet. Post-infection HTTP traffic exposed over 400 infected Windows hosts, mostly in Brazil, with 2,132 Banload-tagged samples observed in the first half of 2017.

Palo Alto Unit 42 · Aug 17, 2026Malware in the wild

Hackers Stole Flock’s Camera Software, Revealing How the Company Tracks Cars and People

Hackers who removed a Flock Safety license plate camera dumped its data, revealing person-detection capabilities and an encryption key stored unencrypted on the device.

A hacker collective calling itself stegan0gram physically removed a Flock Safety automatic license plate reader camera from a roadway, copied its storage, and shared the files with 404 Media, WIRED, and Distributed Denial of Secrets. Analysis found an encryption key in an unencrypted 'media' partition that unlocked videos of thousands of vehicle detections, with logs showing more than a million images generated in weeks. The software explicitly detects people, bicycles, and even bumper stickers, and records from one Georgia city were searchable by more than 2,000 agencies nationwide. The findings follow 2025 research by Jon Gaines documenting flaws enabling root-level access to Flock cameras.

404 Mediaupdated · 9h agofirst · 20h agoResearch in the wild 3 sources

Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self

Unit 42 uncovered Eleethub, a Perl-based Bitcoin mining botnet using a crafted rootkit and libprocesshider to evade detection, still under development with few infections.

Unit 42 discovered an under-development Perl Shellbot campaign that mines Bitcoin using xmrig and emech while evading detection via a rootkit that replaces the ps tool and the LD_PRELOAD-based libprocesshider.so library. Infected devices download a malicious shell script, connect to IRC-based C2 at eleethub.com and the UnderNet network, and can receive commands for UDP/TCP floods, port scans, and HTTP attacks. The botnet can affect Unix systems and Windows 10 hosts running a Linux subsystem, and its operators use the 'Los Zetas' branding, though they are unlikely to be the Mexican drug cartel. Researchers found only a few compromised 'zombies' before the campaign expanded.

Palo Alto Unit 42 · 28d agoMalware in the wild

Campaign Evolution: Darkleech to Pseudo

Unit 42 traces the pseudo-Darkleech campaign, which compromises websites to inject scripts redirecting visitors to exploit kits delivering ransomware.

Palo Alto Networks Unit 42 analyzed the evolution of the pseudo-Darkleech campaign, which injects malicious script into compromised Apache, IIS and WordPress sites to redirect visitors to exploit kits such as Angler and Neutrino. The original Darkleech Apache module infected thousands of servers starting in 2012 and delivered Blackhole EK until that kit disappeared after Paunch's 2013 arrest. From 2015 onward, pseudo-Darkleech delivered ransomware families like CryptoWall and TeslaCrypt, and by early 2016 its injected scripts added obfuscated numeric blocks with frequently changing separator characters. Unit 42 tracks these patterns to help defenders identify compromised websites.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild

Russian network monitoring firm confirms cyberattack claimed by pro

Russian firm Microolap confirmed hackers hit non-critical systems, disputing pro-Ukraine group Black Spark's claims of access to core platform and customer data.

Russian network monitoring software developer Microolap confirmed hackers compromised several rarely used development systems, an outdated website, and an old Bitrix24 customer management system, but denied claims that attackers reached its EtherSensor platform or stole data from customers like Russian Railways, Goznak, and VTB Bank. The pro-Ukraine group Black Spark claimed a month-long intrusion with data extraction and deletion, publishing screenshots Microolap disputes. The company isolated affected systems and engaged an unnamed major Russian cybersecurity firm for investigation.

The Record · 26d agoData breach in the wild1

Automatically Detecting DNS Hijacking in Passive DNS

Unit 42's machine learning pipeline detected 6,729 DNS hijacking events between March and September 2024, hitting political parties, ISPs, and universities.

Unit 42 processes roughly 167 million new DNS records daily and applies a machine learning model using 74 features over 169 TB of passive DNS and geolocation data to flag hijacked domains. From March to September 2024 the pipeline screened over 29 billion records and classified 6,729 as DNS hijacking, averaging 38 detections per day; a new model detects hijacks in customer traffic within about 10 minutes. Notable cases include a Hungarian political party's hijacked domain, defacement of a large utility company and ISP, and university and research center domains repurposed for illicit gambling. DNS hijacking typically relies on stolen registrar or DNS provider credentials or cache poisoning, enabling MitM attacks, phishing, drive-by downloads, and scams.

Palo Alto Unit 42 · Aug 17, 2026Research in the wild

Campaign Evolution: EITest from October through December 2016

Unit 42 details the EITest campaign's late-2016 changes: gates and obfuscation dropped, with Rig EK variants delivering ransomware and infostealers.

Unit 42 tracks the EITest campaign through late 2016, noting it abandoned the gate between compromised websites and exploit kit landing pages after its October 2016 report, and stopped obfuscating injected script URLs by October 15. The campaign primarily uses the Rig-E (Empire Pack) variant and sometimes Rig-V of Rig EK to deliver Cerber and CryptoMix ransomware plus infostealers such as Gootkit, the Chthonic banking Trojan, Ursnif variants, and Latentbot. Tracked since 2014 by Malwarebytes Labs and others, EITest targets unpatched Windows systems without specific victimology.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild

Locky Ransomware Installed Through Nuclear EK

Unit 42 reports Locky ransomware delivered through the Nuclear exploit kit using Flash exploits, adding a drive-by path to existing malspam distribution.

Unit 42 observed Locky ransomware being delivered by the Nuclear exploit kit in March 2016 via Flash exploits, following February reports of Neutrino EK distributing Locky. Infections follow a drive-by chain through a gate to the Nuclear EK, which either installs Locky directly or drops a downloader that retrieves it from another domain. Locky retains two distribution paths: malspam with malicious Office macros or JavaScript attachments and exploit kit traffic triggered by casual web browsing.

Palo Alto Unit 42 · Aug 17, 2026Ransomware in the wild1

CryptoBit: Another Ransomware Family Gets an Update

Palo Alto Unit 42 analyzes updated CryptoBit ransomware distributed via the Rig exploit kit, documenting IOCs, eight sample hashes, and disguise tactics from June 2016.

Unit 42 observed an updated CryptoBit ransomware variant (also tracked as CriptoBit or Mobef) delivered through the Rig exploit kit via the gate domain realstatistics.info between June 17-27, 2016. Infections targeted Windows hosts with out-of-date Flash plugins, and post-infection callbacks used fake user-agents and referrers to disguise traffic to laoismacau.com. At least eight samples were collected, and by June 27 the campaign had begun distributing other malware.

Palo Alto Unit 42 · Aug 17, 2026Ransomware in the wild