Found 42 bookmarks
Custom sorting
Muddled Libra’s Evolution to the Cloud
Muddled Libra’s Evolution to the Cloud
Unit 42 researchers have discovered that the Muddled Libra group now actively targets software-as-a-service (SaaS) applications and cloud service provider (CSP) environments. Organizations often store a variety of data in SaaS applications and use services from CSPs. The threat actors have begun attempting to leverage some of this data to assist with their attack progression, and to use for extortion when trying to monetize their work.
#unit42#EN#2024#paloaltonetworks#MuddledLibra#research#CSP#software-as-a-service
·unit42.paloaltonetworks.com·
Muddled Libra’s Evolution to the Cloud
Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
Two ongoing campaigns bear hallmarks of North Korean state-sponsored threat actors, posing in job-seeking roles to distribute malware or conduct espionage.
#unit42#EN#2023#North-Korea#Job-Related#Campaigns#threat-actor#job-seeking#malware#espionage
·unit42.paloaltonetworks.com·
Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
Blowing Cobalt Strike Out of the Water With Memory Analysis
Blowing Cobalt Strike Out of the Water With Memory Analysis
Unit 42 researchers examine several malware samples that incorporate Cobalt Strike components, and discuss some of the ways that we catch these samples by analyzing artifacts from the deltas in process memory at key points of execution. We will also discuss the evasion tactics used by these threats, and other issues that make their analysis problematic.
#unit42#EN#2022#CobaltStrike#analysis#paloaltonetworks
·unit42.paloaltonetworks.com·
Blowing Cobalt Strike Out of the Water With Memory Analysis
When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors
When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors
Unit 42 continuously hunts for new and unique malware samples that match known advanced persistent threat (APT) patterns and tactics. On May 19, one such sample was uploaded to VirusTotal, where it received a benign verdict from all 56 vendors that evaluated it. Beyond the obvious detection concerns, we believe this sample is also significant in terms of its malicious payload, command and control (C2), and packaging.
#unit42#EN#2022#BruteRatelC4#CobaltStrike#redteam#APT#BRc4#C2#malware
·unit42.paloaltonetworks.com·
When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors
Blowing Cobalt Strike Out of the Water With Memory Analysis
Blowing Cobalt Strike Out of the Water With Memory Analysis
Unit 42 researchers examine several malware samples that incorporate Cobalt Strike components, and discuss some of the ways that we catch these samples by analyzing artifacts from the deltas in process memory at key points of execution. We will also discuss the evasion tactics used by these threats, and other issues that make their analysis problematic.
#unit42#EN#2022#CobaltStrike#analysis#paloaltonetworks
·unit42.paloaltonetworks.com·
Blowing Cobalt Strike Out of the Water With Memory Analysis