Documents
0
Active Sources
0
CVEs
0
IOCs
0

Intelligence Feed

ALL BleepingComputer Check Point Cisco Talos CrowdStrike ESET Elastic Kaspersky Krebs Mandiant Microsoft Palo Alto Proofpoint Rapid7 Recorded Future SentinelOne THN
ALL CRITICAL HIGH MEDIUM LOW
Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files
Unit 42 15 May 2026 SEV 5/10
malware vulnerability Conti
Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files Threat Research Center Threat Research Malware Malware min read Related Products Advanced DNS Security Advanced Threat Prevention Advanced URL Filtering Advanced WildFire Cloud-Delivered Security Services Cortex Cortex XDR Cortex XSIAM Unit 42 Incident Response By: Pranay Kumar Chhaparwal Mark Lim Published: May 15, 2026 Categories: Malware Threat Research Tags: API Cryptocurrency Gremlin stealer Obfuscation Payload Telegram VirusTotal Executive Summary This article examines new obfuscation techniques the Gremlin stealer malware uses to conceal malicious payloads within embedded resources. We analyze a variant protected by a sophisticated commercial packing utility that employs instruction virtualization, transforming the original code into a custom, non-standard bytecode executed by a private virtual machine. Gremlin stealer siphons sensitive information from compromised systems and exfiltrates it to attacker‑controlled servers for potential publication or sale.
Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools
Unit 42 11 May 2026 SEV 8/10
vulnerability identity_threat APT28 Fancy Bear
Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools Threat Research Center Threat Research Malware Malware min read Related Products Cortex Cortex Cloud Cortex XDR Cortex XSIAM Unit 42 Incident Response By: Stav Setty Tom Fakterman Shachar Roitman Published: May 11, 2026 Categories: Malware Threat Research Tags: Active Directory AD CS attacks Certificate template Certipy ESC1 Fighting Ursa Microsoft PKI Shadow credentials Executive Summary Active Directory Certificate Services (AD CS) is a foundational component of Windows enterprise infrastructure, responsible for managing public key infrastructure (PKI) and issuing certificates that enable authentication and encryption across networks. Despite its critical role in the enterprise identity infrastructure, AD CS is often undermined by insecure default configurations and design complexities, resulting in exploitable attack surfaces. Due to misconfigured templates and overly permissive enrollment rights, AD CS has emerged as a high-impact, under-monitored vector for privilege escalation and unauthorized identity impersonation in modern environments.
Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution
Unit 42 07 May 2026 SEV 9/10
vulnerability malware APT41 Volt Typhoon
Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution Threat Research Center High Profile Threats Vulnerabilities Vulnerabilities min read Related Products Advanced DNS Security Advanced Threat Prevention Advanced URL Filtering Advanced WildFire Cloud-Delivered Security Services Cortex Cortex Cloud Cortex Xpanse Next-Generation Firewall Unit 42 Incident Response By: Justin Moore Unit 42 Published: May 6, 2026 Categories: High Profile Threats Vulnerabilities Tags: CVE-2026-0300 EarthWorm PAN-OS Remote Code Execution ReverseSocks5 Vulnerability Zero-day Executive Summary On May 6, 2026, Palo Alto Networks released a security advisory for CVE-2026-0300 , identifying a buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software. Vulnerable systems allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. We are aware of only limited exploitation of CVE-2026-0300 at this time.
Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years
Unit 42 05 May 2026 SEV 8/10
vulnerability cloud_security Conti
Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years Threat Research Center High Profile Threats Vulnerabilities Vulnerabilities min read Related Products Cortex Cortex Cloud Cortex XDR Cortex XSIAM Unit 42 Incident Response By: Justin Moore Published: May 5, 2026 Categories: High Profile Threats Vulnerabilities Tags: Containers CVE-2026-31431 Kubernetes Linux Local privilege escalation Page cache Vulnerability Executive Summary On April 29, 2026, researchers publicly disclosed a highly reliable local privilege escalation (LPE) vulnerability tracked as CVE-2026-31431 . This vulnerability is commonly referred to as Copy Fail. Discovered in about an hour through an AI-assisted process , this logic flaw allows an unprivileged local attacker to consistently escalate their access to root across virtually all major Linux distributions released since 2017.
The npm Threat Landscape: Attack Surface and Mitigations (Updated May 1)
Unit 42 02 May 2026 SEV 6/10
supply_chain malware Conti Play
The npm Threat Landscape: Attack Surface and Mitigations (Updated May 1) Threat Research Center High Profile Threats Malware Malware min read Related Products Advanced DNS Security Advanced URL Filtering Cloud-Delivered Security Services Cortex Cortex Cloud Unit 42 Incident Response By: Unit 42 Published: May 1, 2026 Categories: High Profile Threats Malware Tags: Credential Harvesting GitHub Npm packages Obfuscation Payload Supply chain Worm propagation Executive Summary The security of the npm ecosystem reached a critical inflection point in September 2025. The Shai-Hulud worm, a self-replicating malware that automated the compromise and redistribution of malicious packages, marked the end of the “nuisance” era of npm attacks and the beginning of a high-consequence threat landscape. Since that watershed moment, Unit 42 has tracked an aggressive acceleration in the frequency and technical depth of supply chain compromises.
Essential Data Sources for Detection Beyond the Endpoint
Unit 42 01 May 2026 SEV 4/10
cloud_security iot_ot_security Conti
Essential Data Sources for Detection Beyond the Endpoint Threat Research Center Insights General General min read Related Products Cortex Cortex XDR Cortex XSIAM Unit 42 Frontier AI Defense Unit 42 Incident Response By: Corey Berman Matt Gayford Published: May 1, 2026 Categories: General Insights Tags: Cloud Security IAM Incident response Threat detection 2026 Unit 42 Global Incident Response Report delivers a sharp wake-up call: Threat actors are now moving 4x faster to exfiltration than in 2025. While the endpoint remains a critical first line of defense, the rapid proliferation of cloud services, microservices and remote users has expanded the attack surface beyond what any single tool can monitor. In 75% of incidents Unit 42 investigated, critical evidence of the initial intrusion was present in the logs.
That AI Extension Helping You Write Emails? It’s Reading Them First
Unit 42 30 Apr 2026 SEV 5/10
malware vulnerability Play
That AI Extension Helping You Write Emails? It’s Reading Them First Threat Research Center Threat Research Malware Malware min read Related Products Advanced DNS Security Advanced URL Filtering Advanced WildFire Cloud-Delivered Security Services Prisma AIRS Prisma Browser Secure Access Service Edge (SASE) Unit 42 Incident Response By: Shresta Bellary Seetharam Nabeel Mohamed Billy Melicher Oleksii Starov Qinge Xie Fang Liu Published: April 30, 2026 Categories: Malware Threat Research Tags: AI browser Browser extension GenAI Infostealer Malware Remote Access Trojan Search hijacker Spyware Executive Summary We found 18 AI browser extensions marketed as productivity tools that are not as they seem. This group includes extensions such as: One that surveils your emails as you compose them Another that intercepts ChatGPT prompts A third that exfiltrates passwords Leveraging the rise of generative AI (GenAI), these extensions deliver remote access Trojans (RATs), meddler-in-the-middle (MitM) attacks and infostealers that target prompts, user behavior and browser sessions.
TGR-STA-1030: New Activity in Central and South America
Unit 42 24 Apr 2026 SEV 2/10
cloud_security iot_ot_security
TGR-STA-1030: New Activity in Central and South America Threat Research Center Insights General General min read Related Products Unit 42 Incident Response By: Unit 42 Published: April 24, 2026 Categories: General Insights Tags: TGR-STA-1030 TGR-STA-1030 remains an active threat. Since February, we have observed widespread activity from this group across multiple countries. Most recently, their efforts appear to be heavily focused on regions within Central and South America.
Frontier AI and the Future of Defense: Your Top Questions Answered
Unit 42 23 Apr 2026 SEV 3/10
vulnerability cloud_security
Frontier AI and the Future of Defense: Your Top Questions Answered Threat Research Center Insights General General min read Related Products Unit 42 AI Security Assessment Unit 42 Frontier AI Defense Unit 42 Incident Response By: Sam Rubin Published: April 23, 2026 Categories: General Insights Tags: GenAI LLM N-day Open source Over the last several weeks, Palo Alto Networks and Unit 42 have been talking with CISOs and security leaders globally to discuss the emergence of frontier AI models and their broader implications on cybersecurity. While the potential for AI-driven innovation is immense, the speed and scale at which these models can be weaponized poses a generational challenge to traditional security programs. We’ve compiled the 10 most frequent questions we are receiving from customers to help you navigate this transition with practical, intelligence-led guidance.
Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System
Unit 42 23 Apr 2026 SEV 4/10
cloud_security vulnerability Conti Play
Lessons From Building an Autonomous Cloud Offensive Multi-Agent System Threat Research Center Threat Research Cloud Cybersecurity Research Cloud Cybersecurity Research min read Related Products Cortex Cortex Cloud Cortex XDR Cortex XSIAM Unit 42 AI Security Assessment Unit 42 Cloud Security Assessment Unit 42 Incident Response By: Yahav Festinger Chen Doytshman Published: April 23, 2026 Categories: Cloud Cybersecurity Research Threat Research Tags: AI Cloud Data exfiltration GCP Google Cloud LLMs Multi-agent Penetration testing Executive Summary The offensive capabilities of large language models (LLMs) have until recently existed as theoretical risks – frequently discussed at security conferences and in conceptual industry reports, but rarely discovered in practical exploits. However, in November 2025, Anthropic published a pivotal report documenting a state-sponsored espionage campaign. In this operation, AI didn't just assist human operators – it became the operator, performing 80-90% of the campaign autonomously, at speeds that no human team could match.
When Wi-Fi Encryption Fails: Protecting Your Enterprise from AirSnitch Attacks
Unit 42 22 Apr 2026 SEV 4/10
vulnerability ransomware Play
When Wi-Fi Encryption Fails: Protecting Your Enterprise from AirSnitch Attacks Threat Research Center Threat Research Malware Malware min read Related Products Cloud-Delivered Security Services IoT Security Unit 42 Incident Response By: Emmanuel Zhou Adam Robbie Rick Wyble Zhutian Liu Zhiyun Qian Zhaowei Tan Srikanth V. Krishnamurthy Mathy Vanhoef Published: April 22, 2026 Categories: Malware Threat Research Tags: AirSnitch MitM Network security Port stealing WiFi encryption Wireless WPA2 WPA3 Executive Summary Enterprises have long trusted Wi-Fi encryption and client isolation to secure their wireless infrastructure. However, we conducted research presented at the NDSS Symposium 2026 that reveals that these safeguards can be breached by a novel set of attack techniques that we call AirSnitch.
Fracturing Software Security With Frontier AI Models
Unit 42 20 Apr 2026 SEV 4/10
vulnerability iot_ot_security Conti
Fracturing Software Security With Frontier AI Models Threat Research Center Insights General General min read Related Products Unit 42 AI Security Assessment Unit 42 Frontier AI Defense Unit 42 Incident Response By: Andy Piazza Published: April 20, 2026 Categories: General Insights Tags: AI Attack path Data exfiltration Malware N-day Open Source Software Zero-day Introduction Unit 42 recently got hands-on with frontier AI models, and our initial findings indicate a major shift in the speed, scale and capability of AI models to identify software vulnerabilities. We are now seeing the first frontier models to demonstrate the autonomous reasoning required to function not merely as a coding assistant, but as a full-spectrum security researcher. This brings worrisome advancements in: Autonomous zero-day discovery Collapsing the patching window for N-days Advanced chaining of complex exploitation paths Real-time adaptation to bypass controls of hardened environments The impact of frontier AI models on the threat landscape goes way beyond vulnerability discovery and exploitation.
Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)
Unit 42 17 Apr 2026 SEV 6/10
phishing vulnerability Conti
Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17) Threat Research Center High Profile Threats Malware Malware min read Related Products Advanced DNS Security Advanced Threat Prevention Advanced URL Filtering App-ID Cloud-Delivered Security Services Cortex Cortex Cloud Cortex XDR Cortex XSIAM Cortex XSOAR Next-Generation Firewall Unit 42 Incident Response By: Unit 42 Published: April 17, 2026 Categories: Hacktivism High Profile Threats Malware Ransomware Tags: APK DDoS attacks GenAI Hacktivism Iran Phishing Tarnished Scorpius Wiper Updates Update April 17, 2026 As of April 17, 2026, Iran has begun restoring limited access to the internet after disconnecting from it for the past 47 days . Iran is limiting domestic access to only websites and applications mirrored on its National Information Network . Iranian Threat Groups Renew Interest in Critical Infrastructure In late March 2026, Unit 42 discovered a new cluster of threat activity we are tracking as CL-STA-1128 (aka Cyber Av3ngers, Storm-0784).
A Deep Dive Into Attempted Exploitation of CVE-2023-33538
Unit 42 16 Apr 2026 SEV 9/10
vulnerability iot_ot_security Conti Play
A Deep Dive Into Attempted Exploitation of CVE-2023-33538 Threat Research Center Threat Research Vulnerabilities Vulnerabilities min read Related Products Advanced DNS Security Advanced Threat Prevention Advanced URL Filtering Advanced WildFire Cloud-Delivered Security Services Cortex Cortex Xpanse Next-Generation Firewall Unit 42 Incident Response By: Asher Davila Malav Vyas Chris Navarrete Published: April 16, 2026 Categories: Threat Research Vulnerabilities Tags: Botnet Command injection CVE-2023-33538 Mirai WiFi routers Executive Summary We identified active, automated scans and probes attempting to exploit CVE-2023-33538 , a vulnerability in several end-of-life TP-Link Wi-Fi router models: TL-WR940N v2 and v4 TL-WR740N v1 and v2 TL-WR841N v8 and v10 The observed payloads are malicious binaries characteristic of Mirai-like botnet malware, which the exploits attempt to download and execute on vulnerable devices. We observed this activity after the Cybersecurity and Infrastructure Security Agency’s (CISA) June 2025 addition of this CVE (Common Vulnerabilities and Exposures) to its Known Exploited Vulnerabilities (KEV) Catalog . There has been some discussion of how impactful (or not) these active campaigns might have been.
Cracks in the Bedrock: Agent God Mode
Unit 42 08 Apr 2026 SEV 3/10
cloud_security vulnerability
Cracks in the Bedrock: Agent God Mode Threat Research Center Threat Research Malware Malware min read Related Products Cortex Cortex Cloud Unit 42 AI Security Assessment Unit 42 Cloud Security Assessment Unit 42 Incident Response By: Ori Hadad Published: April 8, 2026 Categories: Malware Threat Research Tags: Agentcore AI agents AWS Bedrock DNS tunneling Exfiltration IAM Identity Killchain Privilege escalation Sandbox Executive Summary Our first article about the boundaries and resilience of Amazon Bedrock AgentCore focused on the Code Interpreter sandbox, and how it can be bypassed using DNS tunneling. In this second part, we delve into the identity and permissions model of AgentCore and the AgentCore starter toolkit . This toolkit is described by AWS as “a Command Line Interface (CLI) toolkit that you can use to deploy AI agents to an Amazon Bedrock AgentCore Runtime.” This toolkit abstracts backend provisioning complexity by automating the creation of runtimes, Amazon Elastic Container Registry ( ECR ) images and execution roles.