Unit 42 reports AI tools aiding cyberespionage and extortion
Threat actors integrate LLMs for social engineering while state-sponsored groups focus on IP theft.
1
Stories per day · 30 days
5 RSS
Relatedcrowdstrike2mandiant2ai-assisted1cl-unk-12111credential-theft1dfir1government1incident-response1kroll1linux1retainer1sygnia1sysgorat1threat-intel1webshell1
69 stories, newest first · one card per story
Stories tagged #unit42
Mandiant tops 2026 incident response retainer ranking
Mandiant leads with guaranteed bench access; Unit 42 offers flexible credits in 2026 IR retainer rankings.
1
Mandiant leads 2026 DFIR company rankings
Mandiant tops for APT depth while CrowdStrike excels in telemetry-accelerated response in 2026 DFIR rankings.
AI-Assisted Hackers Compromise Government Linux Servers to Deploy Backdoors and Steal Credentials
Unit 42 says unattributed cluster CL-UNK-1211 backdoored government Linux servers and stole administrator credentials.
Blinder Tunnel Campaign Targets Iraqi Infrastructure
Unit 42 attributes the Blinder Tunnel campaign to Iranian state-aligned CL-STA-1178, which impersonated Dubai Airports IT to hit Iraqi critical infrastructure.
11
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
Citrix reports NetScaler ADC and Gateway zero-days CVE-2026-88771/88772 (CVSS 9.5) exploited in the wild, with over 50,000 exposed instances.
From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies
Unit 42 analyzes how AWS's AWSCompromisedKeyQuarantine managed policy automatically neutralizes exposed IAM access keys, plus monitoring strategies for quarantine events.
4
A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity
Unit 42 found AWS AgentCore's default shell tool lets prompt injection reach plaintext AgentCore Identity credentials; AWS closed the report as informative.
7
One Compromised Kubernetes Node Can Expose Every Workload Identity Running on It
Unit42 researchers show a root attacker on a Kubernetes node can manipulate cgroups to make the local SPIRE agent issue other workloads' identities.
1
Kubernetes Attack Lets Hackers Steal SPIFFE Workload Identities and Impersonate Applications
Unit 42 detailed a Kubernetes technique where node-root attackers spoof cgroup selectors to steal SPIFFE/SPIRE workload identities and impersonate applications.
3
Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection
Unit 42 clusters behavior of 40,000+ AWS identities from 125 cloud environments to map functional roles and enable lightweight SQL-based detection.
3
Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker
Unit 42 exposed CL-CRI-1171, a pay-per-install operation using YouTube gaming channels and SEO poisoning to deliver RATs and a Chrome hijacker.
7
Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign
Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.
6
The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE
Unit 42 demonstrates that root access on a Kubernetes node lets attackers spoof SPIFFE/SPIRE attestation and harvest co-located workloads' SVIDs.
5
Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America
Unit 42 documents two AI-assisted intrusion campaigns against Latin American government, utility, and financial organizations using LLM-orchestrated tooling.
AI agents help compress ransomware intrusion to under 10 hours, raising stakes for CISOs
Unit 42 reports AI agents compressed a ransomware intrusion from weeks to under 10 hours, using 50+ MITRE ATT&CK techniques against an enterprise network.
2
AI agents carried out every step of this ransomware attack – then left the victim an 80-page security audit
Unit 42 says a human attacker used AI agents to execute a full ransomware intrusion in under 10 hours, leaving the victim an 80-page security audit.
2
An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation
Unit 42 investigated a ransom attack in which frontier AI agents autonomously breached an enterprise network, compressing weeks of tradecraft into under 10 hours.
2
Vishing campaign abuses Microsoft Teams to give attackers a foothold in company networks
Unit 42 details 'Spring Ring', a vishing campaign using fake IT support on Microsoft Teams to reach 150+ employees at 10+ companies.
2
Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
Unit 42 details the Spring Ring voice phishing campaign abusing Microsoft Teams to deploy malware and target enterprise domain controllers.
1
Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety
Unit 42 research shows LLM safety refusals concentrate in a thin neural layer, motivating external, multi-layered AI security controls.
OT Threat Research
Palo Alto Networks Unit 42 launched an OT Threat Research Lab to study how cyber threats disrupt industrial and critical-infrastructure operations.
Code review used to be the only way to catch these bugs
Palo Alto Networks' Unit 42 says its NOVA system found 14,090 vulnerabilities in 3,915 open-source projects, mostly non-crashing bugs like access control flaws.
The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution
Unit 42's August 2026 report tracks the rise of AI-enabled malware, from brand abuse to agentic execution, and how behavioral detection stops AI-authored code.