Unit 42

@Unit42_Intel

The latest research and news from Unit 42, the Palo Alto Networks (@paloaltontwks) Threat Intelligence and Security Consulting Team covering incident response.

Joined December 2015

82Following

62KFollowers

Pinned

Unit 42@Unit42_Intel · Jul 22

Unit 42's threat brief details active exploitation of SharePoint vulnerabilities. Get actionable intelligence on the attack scope and telemetry-based insights to protect your systems: bit.ly/4kWFkp7

Unit42_Intel's tweet image. Unit 42's threat brief details active exploitation of SharePoint vulnerabilities. Get actionable intelligence on the attack scope and telemetry-based insights to protect your systems: bit.ly/4kWFkp7

9.0K

Unit 42@Unit42_Intel · Jul 25

A website impersonating a popular streaming service uses an "influencer collaboration" theme to trick viewers into running a malicious Windows shortcut for a multi-stage chain, including a WebDAV server, to push #Vidar #infostealer malware. Details at: bit.ly/456t2ET

Unit42_Intel's tweet image. A website impersonating a popular streaming service uses an "influencer collaboration" theme to trick viewers into running a malicious Windows shortcut for a multi-stage chain, including a WebDAV server, to push #Vidar #infostealer malware. Details at: bit.ly/456t2ET

4.0K

Unit 42@Unit42_Intel · Jul 25

In this new Threat Assessment, Unit 42 discusses how Muddled Libra (#ScatteredSpider, #UNC3944) has enhanced its capabilities in 2025, becoming further-reaching, faster and more impactful. See what could be next for this prolific adversary: bit.ly/3EEsb1l

Unit42_Intel's tweet image. In this new Threat Assessment, Unit 42 discusses how Muddled Libra (#ScatteredSpider, #UNC3944) has enhanced its capabilities in 2025, becoming further-reaching, faster and more impactful. See what could be next for this prolific adversary: bit.ly/3EEsb1l

3.0K

Unit 42@Unit42_Intel · Jul 24

Data plane vs. control plane logging: Know the difference. This article is essential reading for cloud defenders — successfully navigate cloud logging across factors that include cost optimization, regulatory requirements and more. bit.ly/3TSi0Oc

Unit42_Intel's tweet image. Data plane vs. control plane logging: Know the difference. This article is essential reading for cloud defenders — successfully navigate cloud logging across factors that include cost optimization, regulatory requirements and more. bit.ly/3TSi0Oc

3.0K

Unit 42@Unit42_Intel · Jul 23

Threat group CL-STA-1020 targets Southeast Asian governments to gather covert intelligence. Tactics Unit 42 has observed include deployment of the novel Windows backdoor we call HazyBeacon, as well as exfiltration via legitimate cloud services. Details: bit.ly/4kStAUN

Unit42_Intel's tweet image. Threat group CL-STA-1020 targets Southeast Asian governments to gather covert intelligence. Tactics Unit 42 has observed include deployment of the novel Windows backdoor we call HazyBeacon, as well as exfiltration via legitimate cloud services. Details: bit.ly/4kStAUN

3.0K

Unit 42@Unit42_Intel · Jul 23

A 2025 version of #SoulStealer, an #infostealer released for educational purposes, is available, featuring updated infrastructure and additional functionality compared to the 2024 version. More info at bit.ly/3IWJEHu

Unit42_Intel's tweet image. A 2025 version of #SoulStealer, an #infostealer released for educational purposes, is available, featuring updated infrastructure and additional functionality compared to the 2024 version. More info at bit.ly/3IWJEHu

4.0K

Unit 42@Unit42_Intel · Jul 22

This research has a laser focus on the following techniques used by the threat actors for a SLOW # TEMPEST campaign: control flow graph (CFG) obfuscation using dynamic jumps and obfuscated function calls. Benefit from our analysis methods: bit.ly/3Gs7El7

Unit42_Intel's tweet image. This research has a laser focus on the following techniques used by the threat actors for a SLOW # TEMPEST campaign: control flow graph (CFG) obfuscation using dynamic jumps and obfuscated function calls. Benefit from our analysis methods: bit.ly/3Gs7El7

3.0K

Unit 42@Unit42_Intel · Jul 20

On July 19, Microsoft issued guidance on CVE-2025-53770, a variant of CVE-2025-49706. At the time of posting, a patch is not available. Learn more about Microsoft’s customer guidance as the situation evolves: msrc.microsoft.com/blog/2025/07/c…

UUnit 42@Unit42_Intel · Jul 19

We are observing active global exploitation of critical Microsoft SharePoint vulns CVE-2025-49704 and CVE-2025-49706. Orgs worldwide are being targeted. Patch immediately. The exploits are real, in-the-wild and pose a serious threat. IoCs we've seen: bit.ly/4kQZS2e

25.0K

Unit 42@Unit42_Intel · Jul 19

Unit42_Intel's tweet image. We are observing active global exploitation of critical Microsoft SharePoint vulns CVE-2025-49704 and CVE-2025-49706.

Orgs worldwide are being targeted. Patch immediately. The exploits are real, in-the-wild and pose a serious threat.

IoCs we've seen: bit.ly/4kQZS2e

123

305

148

67.0K

Unit 42@Unit42_Intel · Jul 18

Initial access broker TGR-CRI-0045 is attributed with medium confidence to Gold Melody. One technique in a recent campaign is to employ ASP.NET View State deserialization for in-memory payload execution. We deconstruct the tooling and more: bit.ly/44COaSY

Unit42_Intel's tweet image. Initial access broker TGR-CRI-0045 is attributed with medium confidence to Gold Melody. One technique in a recent campaign is to employ ASP.NET View State deserialization for in-memory payload execution. We deconstruct the tooling and more: bit.ly/44COaSY

4.0K

Unit 42@Unit42_Intel · Jul 17

Three ClickFix campaigns distributed malware such as #Latrodectus and #LummaStealer. Observed infection chains analyzed here involve compromised websites and PowerShell injection. We include detection strategies for this increasingly common tactic. bit.ly/40KzT5e

Unit42_Intel's tweet image. Three ClickFix campaigns distributed malware such as #Latrodectus and #LummaStealer. Observed infection chains analyzed here involve compromised websites and PowerShell injection. We include detection strategies for this increasingly common tactic. bit.ly/40KzT5e

6.0K

Unit 42@Unit42_Intel · Jul 16

A cluster of attacks is targeting the financial sector across Africa, potentially selling access on the dark web. bit.ly/4lu0lIB

Unit42_Intel's tweet image. A cluster of attacks is targeting the financial sector across Africa, potentially selling access on the dark web. bit.ly/4lu0lIB

3.0K

Unit 42@Unit42_Intel · Jul 15

This article delves into security risks posed by unpatched Apache Tomcat and Camel instances. We present an in-depth analysis of CVE-2025-24813 and CVE-2025-27636 and CVE-2025-29891 as well as findings from our telemetry (including exploit payloads). bit.ly/44aTb68

Unit42_Intel's tweet image. This article delves into security risks posed by unpatched Apache Tomcat and Camel instances. We present an in-depth analysis of CVE-2025-24813 and CVE-2025-27636 and CVE-2025-29891 as well as findings from our telemetry (including exploit payloads). bit.ly/44aTb68

6.0K

Unit 42@Unit42_Intel · Jul 14

A backdoor through a side door? Our latest threat research explains how we detected a cloud-based C2: Threat group CL-STA-1020 misused AWS Lambda URLs to mask malicious activity. bit.ly/4kStAUN

Unit42_Intel's tweet image. A backdoor through a side door? Our latest threat research explains how we detected a cloud-based C2: Threat group CL-STA-1020 misused AWS Lambda URLs to mask malicious activity. bit.ly/4kStAUN

4.0K

Unit 42@Unit42_Intel · Jul 14

Attackers are more frequently using Windows shortcut (LNK) files to distribute malware. We cover four main categories of LNK malware: exploit execution, malicious file execution, in-argument script execution and overlay execution. bit.ly/3InIu7C

Unit42_Intel's tweet image. Attackers are more frequently using Windows shortcut (LNK) files to distribute malware. We cover four main categories of LNK malware: exploit execution, malicious file execution, in-argument script execution and overlay execution. bit.ly/3InIu7C

117

9.0K

Unit 42@Unit42_Intel · Jul 11

Threat actors are actively evolving #ClickFix techniques. Recent campaigns detailed in this article demonstrate obfuscation and use of legitimate binaries for sideloading. Read the full details: bit.ly/40KzT5e

Unit42_Intel's tweet image. Threat actors are actively evolving #ClickFix techniques. Recent campaigns detailed in this article demonstrate obfuscation and use of legitimate binaries for sideloading. Read the full details: bit.ly/40KzT5e

5.0K

Unit 42@Unit42_Intel · Jul 11

A SLOW # TEMPEST campaign employs advanced obfuscation including dynamic jumps and obfuscated function calls. We outline methods for detecting and defeating these techniques, including emulation-based address resolution: bit.ly/3Gs7El7

Unit42_Intel's tweet image. A SLOW # TEMPEST campaign employs advanced obfuscation including dynamic jumps and obfuscated function calls. We outline methods for detecting and defeating these techniques, including emulation-based address resolution: bit.ly/3Gs7El7

3.0K

Unit 42@Unit42_Intel · Jul 10

A far-reaching campaign used JSF*ck as obfuscation to inject malicious JavaScript into more than 270k webpages. The code redirected users to malicious content. We examine how this little-used style relies on type coercion and the campaign's overall aims. bit.ly/4mZ2LjE

Unit42_Intel's tweet image. A far-reaching campaign used JSF*ck as obfuscation to inject malicious JavaScript into more than 270k webpages. The code redirected users to malicious content. We examine how this little-used style relies on type coercion and the campaign's overall aims. bit.ly/4mZ2LjE

4.0K

Unit 42@Unit42_Intel · Jul 9

Cyber risks from Iranian-backed groups are growing. We discuss what to expect, including targeted attacks, hacktivism and potential false-flag operations. Read the full Threat Brief: bit.ly/4lsZeca

Unit42_Intel's tweet image. Cyber risks from Iranian-backed groups are growing. We discuss what to expect, including targeted attacks, hacktivism and potential false-flag operations. Read the full Threat Brief: bit.ly/4lsZeca

3.0K

Unit 42@Unit42_Intel · Jul 8

In-memory IIS tradecraft significantly hinders detection — learn what you can do. This method was used in a campaign by TGR-CRI-0045, which targeted industries from financial services to transportation. Read the full campaign details: bit.ly/44COaSY

Unit42_Intel's tweet image. In-memory IIS tradecraft significantly hinders detection — learn what you can do. This method was used in a campaign by TGR-CRI-0045, which targeted industries from financial services to transportation. Read the full campaign details: bit.ly/44COaSY

3.0K