Extortion and Ransomware Trends January-March 2025
This article examines obfuscation techniques used in popular malware families, and offers some insights into possible opportunities for automating unpacking of these malware samples.
Cortex Cloud Security Research
Cybercrime, Malware, Threat Actor Groups, Cryptocurrency, DPRK, GitHub, Infostealer, JavaScript Malware, Slow Pisces, social engineering
Slow Pisces Targets Developers With Coding Challenges and Introduces New Cu...
Recently, we discovered several new malware samples with unique characteristics that made...
OH-MY-DC: OIDC Misconfigurations in CI/CD
Recently, Unit 42 identified the NOKKI malware family that was used in attacks containing politically-motivated lures targeting Russian and Cambodian speaking individuals or organizations. As part of this resea...
Cloud Threats on the Rise: Alert Trends Show Intensified Attacker Focus on ...
On Dec. 13, the cyber community became aware of one of the most significant cybersecurity events of our time, impacting both commercial and government...
GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded ...
Update April 2: Recent investigations have revealed preliminary steps in the tj-actions and reviewdog compromise that were not known until now. We hav...
Business Email Compromise, Cloud Cybersecurity Research, Threat Research, Amazon Simple Email Service, AWS, IAM, JavaGhost, phishing
JavaGhost’s Persistent Phishing Attacks From the Cloud
Unit 42 researchers have observed phishing activity that we track as TGR-UNK-0011. We assess with high confidence that t...
Stately Taurus Activity in Southeast Asia Links to Bookworm Malware
This article reviews nine vulnerabilities we recently discovered in two utilities called cuobjdump and nvdisasm, both from NVIDIA's Compute Unified De...
Malware, Threat Actor Groups, Threat Research, China, CL-STA-0048, Cobalt Strike, data exfiltration, Mimikatz, PlugX, web shells
CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asi...
We identified a cluster of activity that we track as CL-STA-0048. This cluster targeted hi...
Cybercrime, Malware, Threat Actor Groups, Threat Research, Active Directory, AdFind, ALPHV, Ambitious Scorpius, Blackcat, BloodHound
LDAP Enumeration: Unveiling the Double-Edged Sword of Active Directory
Unit 42 researchers have discovered new security vulnerabilities in the Azure Data Factory...
Cloud Cybersecurity Research, Threat Research, Apache Airflow, Containers, Kubernetes, Microsoft Azure, Microsoft Azure Data Factory
Dirty DAG: New Vulnerabilities in Azure Data Factory’s Apache Airflow Integ...
Unit 42 spent six months researching the China-based cybercrime group Rocke, which is the...
Cybercrime, High Profile Threats, Ransomware, Threat Actor Groups, BlackSuit ransomware, construction, Education, Extortion, Ignoble Scorpius, leaksite
Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware
Unit 42 researchers have observed an increase in BlackSuit r...
Business Email Compromise, Threat Actor Groups, Threat Research, BeaverTail, CL-STA-0237, Contagious Interview, DPRK, Fake IT Worker, InvisibleFerret, Lazarus
Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phish...
Unit 42 researchers identified a North Korean IT worker acti...
Cloud Cybersecurity Research, Threat Research, data exfiltration, Google Cloud, Kubernetes, LLM, poisoned model, privilege escalation, Vertex AI
ModeLeak: Privilege Escalation to LLM Model Exfiltration in Vertex AI
In the race to gain a competitive edge, organizations are increasingly training artificial...
Cybercrime, Threat Actor Groups, Threat Research, C++, CL-CRI-0941, CVE-2017-11317, CVE-2019-18935, GodPotato, Python, Remote Code Execution
Silent Skimmer Gets Loud (Again)
This article introduces a simple and straightforward technique for jailbreaking that we call Deceptive Delight. Deceptive Delight is a multi-turn tech...
Nation-State Cyberattacks, Ransomware, Threat Actor Groups, Threat Research, Cobalt Strike, DPRK, DTrack, Fiddling Scorpius, Infostealer, Jumpy Pisces
Jumpy Pisces Engages in Play Ransomware
Unit 42 has identified Jumpy Pisces, a North Korean state-sponsored threat group associated with the Reconnaissance Gene...
Malware, Threat Actor Groups, Threat Research, Advanced Persistent Threat, BeaverTail, CL-STA-240, Contagious Interview, DPRK, InvisibleFerret, North Korea
Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to ...
Unit 42 has tracked activity from threat actors associated w...
Unraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpy
Unit 42 researchers discovered two malware samples used by the Sparkling Pisces (aka Kimsuky) threat group. This includes an undocumented keylogger, c...