Buyer’s guide compares 12 incident response retainer services
The review weighs SLAs, unused-hour conversion, onboarding and post-acquisition ownership rather than responder reputation alone.
1
Stories per day · 30 days
3 RSS
Relatedcredential-theft4linux3cl-unk-12112deepseek2government2incident-response2sysgorat2universities2web-shell2ai-assisted1ai-generated-payloads1banking1brute-force1credential-abuse1crowdstrike1cve-2024-475751cve-2025-616241drive-by1
42 stories, newest first · one card per story
Stories tagged #unit-42
Attacker used DeepSeek to steal 5,200 Indian university records
Unit 42 says a weak administrator password, not a new software flaw, exposed the MongoDB holding student and staff data.
Unit 42: BUGSTER used DeepSeek V4 in India university data theft
The actor brute-forced a site and stole more than 5,200 student and faculty PII records, Unit 42 says.
AI-scripted campaign hit government Linux servers, Unit 42 says
Cluster CL-UNK-1211 used web shells, a sudo-password hook, and SysGoRAT while hunting databases and mailboxes.
Unit 42 warns of two critical PHP RCE flaws scored 9.2
Unit 42 says it has seen proof-of-concept code and telemetry showing over 22.6 million potentially exposed instances.
Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026
Unit 42 says September 2026 intrusions most often began with edge exploits and abused credentials.
2
Hackers Use AI-Generated Scripts to Hijack Linux Sudo Commands and Steal Passwords
Unit 42 says CL-UNK-1211 used AI-assisted scripts to steal Linux sudo passwords from government targets.
8
AI-Powered Espionage Campaign Targets Government Linux Infrastructure
Unit 42 says cluster CL-UNK-1211 used AI-generated payloads to spy on government Linux infrastructure.
13
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
Unit 42 says UNC5820 stole data on 500-plus FortiGates and deployed memory-resident PEERSTITCH malware.
4
The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk
An opportunistic attacker used stolen credentials and a misconfigured gateway to probe a European bank.
2
Hackers Use Web3 and Blockchain C2 to Hide Supply Chain Attacks Targeting Cloud Credentials
Unit 42 says the ChainDrop npm worm uses Ethereum smart contracts as C2 to steal cloud and developer credentials.
AWS’s repeated problems with AI agent controls illustrates the autonomous agent dilemma
Unit 42 and Zenity say AWS AgentCore defaults let prompt injection steal credentials and move across agents.
OperTraitor Finds Kubernetes Operators With Cluster-Wide Secret Access and Admin Paths
OperTraitor finds Kubernetes operators with excessive RBAC, including IBM CVE-2026-6389 cluster-wide secret access.
1
AgtaBackup RAT Uses Fake Microsoft Store Pages and RMM Tools to Hijack Windows Systems
AgtaBackup RAT uses fake Microsoft Store pages and legitimate RMM tools to steal data from Windows systems.
11
OperTraitors: How Kubernetes Operators Betray Your Security Posture
Unit 42's OperTraitor flags overprivileged Kubernetes operators and found CVE-2026-6389 in IBM Turbonomic.
4
3 Consulting Myths Debunked by Unit 42 Experts
Unit 42 consultants argue more tools, small size, and checkbox GRC do not ensure security.
AWS Automatically Quarantines Exposed IAM Keys Within 10 Seconds of GitHub Leak
AWS quarantined a leaked IAM key 10 seconds after Unit 42 published it to public GitHub.
Inside the Modern SOC: Defending the Cross-Environment Pivot
Unit 42 reports 43% of investigated attacks span four or more attack surfaces, urging SOCs to use AI-driven cross-domain correlation to reconstruct attack paths.
2
Atomic macOS (AMOS) Stealer Activity
Unit 42 details an August 2026 AMOS macOS stealer infection delivered via fake 'macOS toolkit' pages and Terminal paste commands, exfiltrating credentials to C2.
Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks
Unit 42 links two Latin America campaigns where operators used Claude and GPT-4.1 during intrusions against government and financial targets.
4
Hackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America
Unit 42 says Latin American attackers used LLMs to automate post-exploitation in campaigns hitting Mexican government, water utilities, and Brazilian financial firms.
3
Unit 42 Incident Response Archives
Palo Alto Networks Unit 42 markets its paid incident response services backed by threat intelligence and methodology from thousands of investigations.
Unit 42 Frontier AI Defense Archives
Palo Alto Networks Unit 42 markets Frontier AI Defense, a service combining frontier AI models and expert guidance to counter AI-powered attacks.
Unit 42 warns AI has shifted balance of power from defenders to attackers
Unit 42 says agentic AI has shifted attacker advantage, investigating an incident where one attacker exploited 50 enterprise applications in under 10 hours.
2