30
IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
Unit 42 tracks a Mirai botnet campaign exploiting over 20 IoT vulnerabilities in routers, cameras and DVRs to build DDoS botnets since March 2023.
Since March 2023, Unit 42 has tracked threat actors exploiting more than 20 IoT vulnerabilities to spread a Mirai botnet variant, first seen downloading payloads from zvub.us on March 14, 2023. Exploited flaws span CVE-2023-1389 (TP-Link Archer), CVE-2022-30525 (Zyxel), CVE-2022-31499 (Nortek) and many router, camera and DVR bugs. The variant decrypts configuration strings with an XOR key derived from 0xDEADBEEF and lacks built-in credential brute forcing, so spreading relies on manual operator exploitation. Two campaigns observed since October 2022 share infrastructure and near-identical samples.
42
Old Wine in the New Bottle: Mirai Variant Targets Multiple IoT Devices
Unit 42 analyzed the Mirai IZ1H9 botnet variant exploiting Tenda, LB-Link, DCN and Zyxel flaws to build DDoS-capable IoT botnets.
Unit 42 observed the Mirai IZ1H9 variant on April 10, 2023, using a shell script downloader lb.sh from 163.123.143.126 to infect exposed Linux servers and networking devices. Campaigns running since November 2021 share infrastructure, near-identical bot functions and the XOR key 0xBAADF00D. The malware exploits CVE-2023-27076 (Tenda G103), CVE-2023-26801 (LB-Link), CVE-2023-26802 (DCN DCBI-Netlog-LAB) and a Zyxel RCE flaw. Compromised devices join a botnet used for DDoS attacks, and the downloader deletes logs and modifies iptables to block SSH, Telnet and HTTP recovery.
40
Unit 42 warns AI has shifted balance of power from defenders to attackers
Unit 42 says agentic AI has shifted attacker advantage, investigating an incident where one attacker exploited 50 enterprise applications in under 10 hours.
Palo Alto Networks Unit 42 leaders said early waves of agentic AI-enabled attacks are breaking in the wild and that frontier model capabilities have shifted the balance of power from defenders to attackers. The team is actively investigating an attack on a customer where an attacker used an agentic framework to exploit 50 applications and other weaknesses across the enterprise in less than 10 hours, work they estimate would have taken at least 10 days pre-AI. Unit 42 says AI already touches the entire attack chain, including malware development, social engineering, and ransomware negotiations. The warning follows April's Project Glasswing initiative formed with Anthropic around its Mythos model.
60
Mirai Variant V3G4 Targets IoT Devices
Unit 42 tracked the Mirai variant V3G4 exploiting 13 vulnerabilities across IoT devices and servers from July-December 2022 to build a DDoS botnet.
From July to December 2022, Unit 42 observed three campaigns spreading V3G4, a Mirai botnet variant, by exploiting 13 vulnerabilities, including CVE-2022-26134 in Atlassian Confluence and CVE-2019-15107 in Webmin. The campaigns shared the same C2 domains containing the string 8xl9, nearly identical shell script downloaders, and the same XOR keys, suggesting a single threat actor. The malware brute-forces telnet and SSH credentials, terminates rival botnet processes via a stop list, and receives DDoS commands from its C2. Compromised servers and networking devices are absorbed into the botnet for further attacks.
45
45
35
35
30
30
45
30
AI Tool Identifies BOLA Vulnerabilities in Easy!Appointments
Unit 42's AI-powered tool found 15 BOLA vulnerabilities in Easy!Appointments, rated up to CVSS 9.9, letting low-privileged users escalate privileges; fixed in 1.5.0.
Unit 42's automated BOLA detection tool, built on generative AI, uncovered 15 broken object-level authorization flaws in the open-source scheduling application Easy!Appointments, tracked as CVE-2023-3285 through CVE-2023-3290 and CVE-2023-38047 through CVE-2023-38055. Nine flaws scored CVSS 9.9, letting logged-in customers view or manipulate appointments and accounts of providers and admins, including creating admin users for privilege escalation. The maintainers patched all issues in version 1.5.0. The same tool previously found a BOLA in Grafana (CVE-2024-1313).
48
30
30
Stately Taurus Activity in Southeast Asia Links to Bookworm Malware
Unit 42 links Stately Taurus APT activity in ASEAN region and Myanmar to the decade-old Bookworm malware family via infrastructure overlaps.
Unit 42 connected Stately Taurus (aka Mustang Panda) espionage activity targeting ASEAN-affiliated organizations and Myanmar to the Bookworm malware family, first published in 2015. Earlier attacks delivered the PubLoad stager via DLL sideloading, with a PubLoad variant communicating with C2 at 123.253.32[.]15 while mimicking Windows Update URLs. Three previously unreported loader samples from 2021-2022 used UUID-decoded shellcode loaded via heap allocation and API callbacks, ultimately decrypting and loading Bookworm DLLs. A ToneShell backdoor variant shared debug paths with Bookworm loaders, and the January 2024 CSIRT CTI post corroborated the Myanmar attacks.
65
Vishing campaign abuses Microsoft Teams to give attackers a foothold in company networks
Unit 42 details 'Spring Ring', a vishing campaign using fake IT support on Microsoft Teams to reach 150+ employees at 10+ companies.
Palo Alto Networks Unit 42 documented 'Spring Ring', a voice-phishing campaign that ran January to April 2026, using 26 attacker identities and fake Microsoft 365 tenants such as 'ITProtectionDepartment' to impersonate internal IT support on Microsoft Teams. One path used Quick Assist or downloaded remote-support tools to run an obfuscated PowerShell script that disabled malware scanning before contacting C2; the other delivered a cloud-hosted file triggering browser hijacking, SMB internal network scanning, and a PetitPotam NTLM relay attempt against domain controllers to gain domain-level privileges. Both intrusion attempts were blocked before attackers reached their objectives. Collaboration-platform phishing alerts rose to 42% of Unit 42's telemetry in early 2026, up from 30%.
60
30
Mirai Variant MooBot Targeting D
Unit 42 observed the MooBot Mirai variant exploiting four D-Link vulnerabilities to compromise unpatched routers for use in DDoS attacks.
Unit 42 captured attacks exploiting four D-Link remote code execution vulnerabilities: CVE-2015-2051, CVE-2018-6530, CVE-2022-26258, and CVE-2022-28958, with three rated critical at CVSS 9.8. The exploits download the MooBot malware, a Mirai botnet variant, from infrastructure at 159.203.15.179 via wget. Compromised devices fall under full attacker control and can be used for distributed denial-of-service attacks. D-Link has published bulletins for all four flaws, but unpatched devices remain exposed.
40
Google Password Manager Attacks Could Let Malware Hijack Passkey
Unit 42 details three attack paths letting Windows malware silently sign into passkey-protected accounts via Chrome's Google Password Manager without user verification.
Palo Alto Networks Unit 42 described three post-compromise attack paths—Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key—against Chrome's Google Password Manager cloud authenticator on TPM-equipped Windows systems. The attacks can silently obtain valid authentication assertions, install attacker-controlled user-verification keys, or extract the 32-byte Security Domain Secret used to decrypt synced passkey private keys, enabling reusable access from the attacker's own environment. No CVE was assigned and no exploitation in the wild was reported; demonstrations were validated against Chrome 142 and parts of the architecture are corroborated by Chromium source. GitHub enforced the User Verified flag check, while eBay accepted a test assertion lacking it before fixing its validation gap after disclosure.
55
45
30
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing
Three research teams showed passkey bypasses: WebAuthn assertion replay in Microsoft Entra ID, synced-passkey key recovery in Google Password Manager, and Windows Hello key reuse.
SpecterOps' Pass-the-Passkey research showed Windows stored past YubiKey signatures in cleartext and chained this with Microsoft Entra ID passkey validation weaknesses to impersonate privileged users despite phishing-resistant MFA; the Windows Event Logging Service issue is tracked as CVE-2026-34348 (CVSS 6.5) and fixed in July 2026 updates. Unit 42's Golden Pass-ta-key attack recovered the 32-byte Security Domain Secret protecting Google Password Manager synced passkeys from Chrome on Windows via pre-existing malware. Dirk-jan Mollema showed in-session malware can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric check. Microsoft applied Entra-side mitigations for the relay assertion issue; no real-world exploitation has been reported.
65
30
Exploring the Latest Mispadu Stealer Variant
Unit 42 found a new Mispadu infostealer variant targeting Mexican users via malicious .url files exploiting the SmartScreen CVE-2023-36025 bypass.
Unit 42 discovered a new variant of Mispadu Stealer, a Delphi-based banking trojan first reported in 2019, found while hunting for the Windows SmartScreen bypass CVE-2023-36025. The campaign uses crafted .url files referencing UNC network-share paths with an HTTP port (@80) that forces payload retrieval over WebDAV via rundll32.exe, avoiding SmartScreen warnings. Analyzed samples (~4 KB, compiled 2023-11-12) predate the CVE publication, and ZIP payloads were likely distributed as email attachments, primarily targeting users in Mexico.
45
ApateWeb: An Evasive Large-Scale Scareware and PUP Delivery Campaign
Unit 42 uncovers ApateWeb, a campaign using over 130,000 domains and multilayered redirects to deliver scareware, adware and PUPs to millions of users.
Unit 42 discovered ApateWeb, a large-scale campaign using a network of more than 130,000 domains to deliver scareware, potentially unwanted programs, adware including a rogue browser and browser extensions, and scam pages. The campaign uses a three-layer structure with deceptive emails as the entry point, centralized victim tracking via UUIDs, intermediate adware or anti-bot redirections, and evasion tactics such as cloaking, bot detection error pages, and wildcard DNS abuse. Activity spiked since August 2022, with several hundred attacker-controlled sites remaining in Tranco's top 1 million rankings and millions of monthly hits; Unit 42 blocked an estimated 3.5 million sessions across 74,711 devices in November 2023.
55
35
35
35
35
Identifying a BOLA Vulnerability in Harbor, a Cloud
Unit 42 found a BOLA flaw, CVE-2024-22278 (CVSS 6.4), letting Maintainers improperly alter Harbor project metadata; fixed in versions 2.9.5, 2.10.3, and 2.11.0.
Unit 42 researchers identified a broken object-level authorization flaw, CVE-2024-22278, in Harbor, a CNCF-graduated cloud-native container registry with 1.8 million downloads. The flaw (CVSS 6.4) lets users with the Maintainer role create, update, and delete project metadata, actions reserved for ProjectAdmin, risking data exposure, integrity compromise, and circumvention of vulnerability scanning. Harbor patched the issue in versions 2.9.5, 2.10.3, and 2.11.0. The finding came from Unit 42's automated BOLA detection tool built on generative AI.
40
Multiple Vulnerabilities Discovered in a SCADA System
Unit 42 details five vulnerabilities (CVSS 7.0-7.8) in ICONICS Suite SCADA software enabling privilege escalation and DoS.
Unit 42 discovered five vulnerabilities (CVE-2024-1182, CVE-2024-7587, CVE-2024-8299, CVE-2024-8300, CVE-2024-9852) in ICONICS Suite versions 10.97.2 and earlier for Windows during a 2024 security assessment. The flaws, rated CVSS 7.0-7.8, allow DLL hijacking, privilege escalation, information disclosure, denial-of-service and potentially full system compromise. ICONICS Suite is a SCADA solution with hundreds of thousands of installations in over 100 countries, widely used in critical infrastructure, and several dozen servers are internet-exposed per Unit 42 telemetry. ICONICS released patches and advisories with workarounds in 2024.
52
35
Operation Falcon II: Unit 42 Helps INTERPOL Identify Nigerian Business Email Compromise Ring Members
30
New Python-Based Payload MechaFlounder Used by Chafer
Unit 42 identified MechaFlounder, a new Python backdoor used by the Chafer group to target a Turkish government entity via HTTP-based C2.
Unit 42 reports that in November 2018 the Chafer group targeted a Turkish government entity, reusing the win10-update[.]com infrastructure reported earlier in 2018 by ClearSky. The new secondary payload, tracked as MechaFlounder, is Python compiled with PyInstaller and acts as a backdoor supporting file upload/download and command execution. It beacons over HTTP using anomalous GET requests containing the username and hostname, suggesting a custom C2 server rather than a standard web server. Code overlap with OilRig's Clayside VBScript was noted, but Chafer and OilRig remain tracked as separate groups.
44
Kimwolf v7 Hides DDoS Traffic Behind Chrome Fingerprints and Ethereum
Unit 42 details Kimwolf v7, an Android TV botnet upgrade using HTTP/2 Chrome-fingerprint DDoS floods and Ethereum ENS-based C2 across 1.8M+ infected devices.
Palo Alto Networks Unit 42 identified Kimwolf v7 on February 3, 2026, an upgrade to an Android TV botnet active since August 2025 and linked to the AISURU botnet, which has infected over 1.8 million devices. The new version adds an HTTP/2-based DDoS flood that mimics full Chrome browser fingerprints, consolidates 43 attack commands into 15 methods covering layers 3-7, and resolves C2 addresses via Ethereum Name Service using five hard-coded public blockchain RPC endpoints, backed by a Tor hidden service and a local proxy on 127.0.0.1:23075. It spreads through residential proxies to Android TV boxes with ADB enabled on port 5555 and masquerades as netd_service. The botnet is associated with the record 31.4 Tbps DDoS attack in November 2025.
55
30
FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications
Unit 42 dissects FrostyGoop OT malware, which sent Modbus TCP commands to disrupt heating for 600+ apartment buildings in Ukraine.
Palo Alto Unit 42 analyzed new FrostyGoop/BUSTLEBERM samples, the ninth known ICS-centric malware, first used against a Ukrainian municipal energy company by sending Modbus TCP commands to ENCO control devices. The attack caused a two-day heating outage affecting over 600 apartment buildings during sub-zero temperatures. The Go-compiled malware accepts Modbus register operations and timing parameters via command-line arguments or a JSON configuration file, uses an obscure open-source Modbus library, and checks the Windows BeingDebugged flag to evade debuggers. Unit 42 telemetry recorded over 1 million Modbus TCP devices exposed to the internet between September and October 2024.
58
Privileged File System Vulnerability Present in a SCADA System
Unit 42 details CVE-2025-0921 (CVSS 6.5), a privileged file operations flaw in Iconics Suite enabling DoS and privilege escalation.
Unit 42 disclosed CVE-2025-0921 (CVSS 6.5), an execution-with-unnecessary-privileges flaw in the Pager Agent of the AlarmWorX64 MMX feature of Mitsubishi Electric Iconics Digital Solutions GENESIS64. Attackers could misuse privileged file system operations to corrupt critical binaries, causing denial-of-service or integrity loss on vulnerable SCADA systems. The analysis demonstrates a chain with CVE-2024-7587, which grants excessive permissions to the C:\ProgramData\ICONICS directory via the GenBroker32 installer. Iconics released an advisory with a workaround that addresses the reported issues.
38
30