Tag: Unit 42
Government Linux servers fell to scripts an AI likely wrote
Unit 42 traced a year-long espionage campaign that leaned on large language models to build its payloads and mash its…
Ransomware crews keep walking through an old Palo Alto MFA bypass
Months after the PAN-OS fix shipped, Qilin and Inc affiliates still log in with stolen sessions and then encrypt the…
A stealthy implant sat on 500 firewalls after one FortiManager hit
Unit 42 traced a two-year intrusion that turned a single management box into keys for hundreds of networks.
Vishing crews pose as IT help desk inside Microsoft Teams
Unit 42 maps a campaign that hit 150 employees and pushed toward domain controllers.
Kimwolf botnet evolves to mimic browsers with HTTP/2 flood attacks
Unit 42 documents Kimwolf v7, a rebuild that hides DDoS floods behind browser fingerprints and Ethereum domains.
Pass-ta-key attacks turn endpoint malware into passkey account takeover
Unit 42 details three ways malware can abuse Chrome's synced passkey flows to hijack accounts.
XCSSET v40 returns with memory-only macOS supply chain attacks
The XCSSET malware returns as v40 with memory-only execution and a new Chrome-hijacking module.
Autonomous attacks run by DeepSeek agent on a single Telegram order
Unit 42 details a DeepSeek-driven agent that launched attacks after a single Telegram command.