Palo Alto Networks Unit 42

Update 11/22: The threat brief now has additional details on the diversity of post-compromise payloads. Our threat brief on Operation Lunar Peek activity related to CVE-2024-0012 and CVE-2024-9474 is updated with new indicators and additions to the Current Scope of the Attack section: https://bit.ly/4fYK9MF A complete list of indicators is now available on GitHub. See comments for the link.

We discovered 1,000+ Christmas-themed #scam sites offering fake internet data giveaways. These pages bait victims into sharing with WhatsApp friends and lead to fake surveys, shopping sites or app store pages for potentially unwanted programs. More info at https://bit.ly/3OKJhQh

Real-world scenarios underscore the necessity of robust security measures to safeguard macOS environments from malicious lateral movement maneuvers. We walk analysts through multiple examples, including SSH key theft, where attackers can gain unauthorized access by misusing stolen or exfiltrated SSH keys. Delve into the rest now: https://bit.ly/4fZ3HR6

Ignoble Scorpius, the cybercrime actors behind BlackSuit ransomware, conduct complex supply chain attacks and have compromised at least 93 organizations — without a public-facing RaaS program. Our threat assessment offers a strategic framework for cybersecurity professionals, employing MITRE ATT&CK principles for effective action. https://bit.ly/40UROaf

Mind the (AI and Cybersecurity) gap ???? This week, Harriet Farlow, CEO of Mileva Security Labs, joined Michael Heller, Executive Producer on Threat Vector, to share her expertise on using the advent of AI tools to bridge gaps in your cybersecurity posture. Harriet, a leader in adversarial machine learning, pointed out; “It still doesn’t take much to hack a model, yet there’s no requirement that companies secure them.” This conversation is essential for cybersecurity leaders looking to understand AI’s security gaps and the actions needed to protect our evolving digital landscape. Tune in to learn how Harriet’s team at Mileva Security Labs is bridging the gaps in AI security and hear her thoughts on where industry policy should head next. https://bit.ly/4fSs8zu

This threat brief on CVE-2024-0012 and CVE-2024-9474 has been revised to include new indicators and updated guidance on post-compromise activity, as well as information on scanning activity: https://bit.ly/4fYK9MF

Plunged into sub-zero temperatures, over 600 apartment buildings in a Ukrainian city experienced interrupted heating services when FrostyGoop malware was used to target a municipal energy company's industrial systems. Since this early 2024 incident, analysts have identified this malware as the first to manipulate Modbus TCP communications. https://bit.ly/3OjdchS

2024-11-19 (Tuesday) We've discovered new infrastructure and domains for the #ApateWeb campaign that includes 2.4k new domains and 5 new IP addresses that lead to sites for potentially unwanted applications (#PUP) and #scam pages. More info at https://bit.ly/4fXarik

Our threat brief on CVE-2024-0012 and CVE-2024-9474 has been updated to include new IoCs, as well as expand the Current Scope of the Attack section — read the details now: https://bit.ly/4fYK9MF

1,346 domains registered in the past 3 months, peaking 11/03/24, redirect users to gambling or adult-themed pages distributing potential unwanted programs (PUPs) for Android. Some sites force multiple downloads of the same APK. More info: https://bit.ly/4ewMYU5 #AndroidPUPs