Found 50 bookmarks
Custom sorting
Bad Likert Judge: A Novel Multi-Turn Technique to Jailbreak LLMs by Misusing Their Evaluation Capability
Bad Likert Judge: A Novel Multi-Turn Technique to Jailbreak LLMs by Misusing Their Evaluation Capability
The jailbreak technique "Bad Likert Judge" manipulates LLMs to generate harmful content using Likert scales, exposing safety gaps in LLM guardrails. The jailbreak technique "Bad Likert Judge" manipulates LLMs to generate harmful content using Likert scales, exposing safety gaps in LLM guardrails.
#unit42#EN#2024#LLM#Jailbreak#Likert
·unit42.paloaltonetworks.com·
Bad Likert Judge: A Novel Multi-Turn Technique to Jailbreak LLMs by Misusing Their Evaluation Capability
Effective Phishing Campaign Targeting European Companies and Organizations
Effective Phishing Campaign Targeting European Companies and Organizations
A phishing campaign targeting European companies used fake forms made with HubSpot's Free Form Builder, leading to credential harvesting and Azure account takeover. A phishing campaign targeting European companies used fake forms made with HubSpot's Free Form Builder, leading to credential harvesting and Azure account takeover.
#unit42#EN#2024#Phishing#Campaign#EU#Azure#takeover#HubSpot#analysis
·unit42.paloaltonetworks.com·
Effective Phishing Campaign Targeting European Companies and Organizations
Lateral Movement on macOS: Unique and Popular Techniques and In-the-Wild Examples
Lateral Movement on macOS: Unique and Popular Techniques and In-the-Wild Examples
We uncover macOS lateral movement tactics, such as SSH key misuse and AppleScript exploitation. Strategies to counter this attack trend are also discussed. We uncover macOS lateral movement tactics, such as SSH key misuse and AppleScript exploitation. Strategies to counter this attack trend are also discussed.
#unit42#EN#2024#macOS#ARD#AppleScript#attacks#lateral-movement#tactics
·unit42.paloaltonetworks.com·
Lateral Movement on macOS: Unique and Popular Techniques and In-the-Wild Examples
Chinese APT Abuses VSCode to Target Government in Asia
Chinese APT Abuses VSCode to Target Government in Asia
A first in our telemetry: Chinese APT Stately Taurus uses Visual Studio Code to maintain a reverse shell in victims' environments for Southeast Asian espionage. A first in our telemetry: Chinese APT Stately Taurus uses Visual Studio Code to maintain a reverse shell in victims' environments for Southeast Asian espionage.
#unit42#EN#2024#China#APT#StatelyTaurus#VisualStudio
·unit42.paloaltonetworks.com·
Chinese APT Abuses VSCode to Target Government in Asia
Spoofed GlobalProtect Used to Deliver Unique WikiLoader Variant
Spoofed GlobalProtect Used to Deliver Unique WikiLoader Variant
Unit 42 discusses WikiLoader malware spoofing GlobalProtect VPN, detailing evasion techniques, malicious URLs, and mitigation strategies. Unit 42 discusses WikiLoader malware spoofing GlobalProtect VPN, detailing evasion techniques, malicious URLs, and mitigation strategies.
#unit42#EN#2024#WikiLoader#malware#spoofing#GlobalProtect#VPN
·unit42.paloaltonetworks.com·
Spoofed GlobalProtect Used to Deliver Unique WikiLoader Variant
Leveraging DNS Tunneling for Tracking and Scanning
Leveraging DNS Tunneling for Tracking and Scanning
This article presents a case study on new applications of domain name system (DNS) tunneling we have found in the wild. These techniques expand beyond DNS tunneling only for command and control (C2) and virtual private network (VPN) purposes. Malicious actors occasionally employ DNS tunneling as a covert communications channel, because it can bypass conventional network firewalls. This allows C2 traffic and data exfiltration that can remain hidden from some traditional detection methods.
#unit42#EN#2024#DNS#Tunneling#Tracking#Scanning#research#analysis
·unit42.paloaltonetworks.com·
Leveraging DNS Tunneling for Tracking and Scanning
Muddled Libra’s Evolution to the Cloud
Muddled Libra’s Evolution to the Cloud
Unit 42 researchers have discovered that the Muddled Libra group now actively targets software-as-a-service (SaaS) applications and cloud service provider (CSP) environments. Organizations often store a variety of data in SaaS applications and use services from CSPs. The threat actors have begun attempting to leverage some of this data to assist with their attack progression, and to use for extortion when trying to monetize their work.
#unit42#EN#2024#paloaltonetworks#MuddledLibra#research#CSP#software-as-a-service
·unit42.paloaltonetworks.com·
Muddled Libra’s Evolution to the Cloud
Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
Two ongoing campaigns bear hallmarks of North Korean state-sponsored threat actors, posing in job-seeking roles to distribute malware or conduct espionage.
#unit42#EN#2023#North-Korea#Job-Related#Campaigns#threat-actor#job-seeking#malware#espionage
·unit42.paloaltonetworks.com·
Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors
Blowing Cobalt Strike Out of the Water With Memory Analysis
Blowing Cobalt Strike Out of the Water With Memory Analysis
Unit 42 researchers examine several malware samples that incorporate Cobalt Strike components, and discuss some of the ways that we catch these samples by analyzing artifacts from the deltas in process memory at key points of execution. We will also discuss the evasion tactics used by these threats, and other issues that make their analysis problematic.
#unit42#EN#2022#CobaltStrike#analysis#paloaltonetworks
·unit42.paloaltonetworks.com·
Blowing Cobalt Strike Out of the Water With Memory Analysis