ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “network traffic analysis”

324 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 97Malware 69Vulnerability 44Threat actor 42Ransomware 33Data breach 18Phishing & fraud 13AI safety & security 5Policy & legal 4Advisory 2Research 1
SeverityAllcritical 221high 49medium 49low 8info 1

FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications

Unit 42 dissects FrostyGoop OT malware, which sent Modbus TCP commands to disrupt heating for 600+ apartment buildings in Ukraine.

Palo Alto Unit 42 analyzed new FrostyGoop/BUSTLEBERM samples, the ninth known ICS-centric malware, first used against a Ukrainian municipal energy company by sending Modbus TCP commands to ENCO control devices. The attack caused a two-day heating outage affecting over 600 apartment buildings during sub-zero temperatures. The Go-compiled malware accepts Modbus register operations and timing parameters via command-line arguments or a JSON configuration file, uses an obscure open-source Modbus library, and checks the Windows BeingDebugged flag to evade debuggers. Unit 42 telemetry recorded over 1 million Modbus TCP devices exposed to the internet between September and October 2024.

Palo Alto Unit 42 · 28d agoMalware in the wild

Russian network monitoring firm confirms cyberattack claimed by pro

Russian firm Microolap confirmed hackers hit non-critical systems, disputing pro-Ukraine group Black Spark's claims of access to core platform and customer data.

Russian network monitoring software developer Microolap confirmed hackers compromised several rarely used development systems, an outdated website, and an old Bitrix24 customer management system, but denied claims that attackers reached its EtherSensor platform or stole data from customers like Russian Railways, Goznak, and VTB Bank. The pro-Ukraine group Black Spark claimed a month-long intrusion with data extraction and deletion, publishing screenshots Microolap disputes. The company isolated affected systems and engaged an unnamed major Russian cybersecurity firm for investigation.

The Record · 26d agoData breach in the wild1

Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics

Unit 42 tracks the new Mole ransomware (CryptoMix family) spread via USPS-themed malspam, with tactics escalating to JavaScript downloaders dropping multiple malware families.

On April 11, 2017, a malspam campaign began distributing Mole ransomware, a CryptoMix-family strain, through USPS-themed emails linking to fake Microsoft Word Online sites offering a bogus Office plugin. By April 13 the campaign added Nemucod JavaScript downloaders installing Mole alongside Kovter and Miuref, and by April 18 it switched to the KINS banking Trojan before moving to speeding-ticket themes and a fake parking services website. Unit 42 notes the rapid tactic changes are likely intended to evade detection, and CryptoMix variants like Mole are typically repackaged within weeks.

Palo Alto Unit 42 · Aug 17, 2026Ransomware in the wild

Risky Bulletin: Two TeamPCP members arrested in Australia

Australian Federal Police arrested two alleged TeamPCP members behind supply-chain worm attacks that stole over 500,000 credentials from compromised open-source libraries.

The AFP arrested alleged TeamPCP leader Ruben Thomson, 21, and Louis Gaebler, 23, near Perth; both were charged and remain in custody. The group inserted a self-spreading credential-stealing worm into open-source projects including Trivy, KICS, LiteLLM, and Telnyx, harvesting more than 500,000 credentials used for network access, ransomware, extortion, and sales. About 78,000 tokens and secrets from nearly 2,200 organizations leaked online last month, and the FBI supported the investigation that began in April.

Risky Business News · 19d agoPolicy & legal in the wild1

Analysis of Smoke Loader in New Tsunami Campaign

Fake Japanese Meteorological Agency tsunami warning emails delivered Smoke Loader and AzoRult malware to steal credentials from targets in Japan.

A fake tsunami warning email impersonating Japan's Meteorological Agency asked recipients to click a link on a registered fake agency domain, delivering the commodity loader Smoke Loader to targets in Japan. Smoke Loader, active since 2011, is modular, and its payloads have included banking trojans, ransomware, cryptominers, password stealers, and PoS malware; the campaign later also deployed AzoRult. New samples add junk-jump obfuscation, encrypted network traffic and payload files, a unique machine ID used for tracking and encryption, and PROPagate injection into explorer.exe, with persistence via a Startup folder shortcut and RC4-encrypted C2 communication.

Palo Alto Unit 42 · Aug 17, 2026Malware in the wild

Network Abuses Leveraging High-Profile Events: Suspicious Domain Registrations and Other Scams

Unit 42 found scammers surge deceptive domain registrations around major events like the 2024 Paris Olympics to run phishing and counterfeit merchandise scams.

Unit 42 analyzed newly registered domains (over 200,000 detected daily from zone files, WHOIS, and passive DNS) containing event-specific keywords, using the 2024 Paris Summer Olympics as a case study. Threat actors register lookalike domains to sell counterfeit merchandise, push fraudulent services, and run phishing, as previously seen with COVID-19-themed and fake ChatGPT tool scams. The article recommends monitoring domain registrations, DNS and URL traffic trends, textual patterns, and verdict change requests to catch event-themed abuse early.

Palo Alto Unit 42 · Aug 17, 2026Phishing & fraud in the wild