Sofacy Attacks Multiple Government Entities
Unit 42 examines recent Sofacy group activities including multiple attacks to government entities.
Palo Alto Networks
Trojan
Malspam Targeting Brazil Continues to Evolve
Unit 42 examines the evolution of malspam targeting Microsoft windows hosts in Brazil.
Cardinal RAT Active for Over Two Years
Unit 42 researchers discover a previously unknown Trojan (RAT) that uses an innovative downloader embedded in malicious excel documents.
2016 Updates to Shifu Banking Trojan
Shifu is a Banking Trojan first discovered in 2015. Shifu is based on the Shiz source code which incorporated techniques used by Zeus. Attackers use Shifu to steal credentials for online banking websites around the world, starting in Russia but later including the UK, I...
Sofacy’s ‘Komplex’ OS X Trojan
Unit 42 researchers identified a new OS X Trojan associated with the Sofacy group that we are now tracking with the 'Komplex' tag using the Palo Alto Networks AutoFocus threat intelligence platform.
DualToy: New Windows Trojan Sideloads Risky Apps to Android and iOS Devices
Over the past two years, we’ve observed many cases of Microsoft Windows and Apple iOS malware designed to attack mobile devices. This attack vector is increasingly popular with mal...
Fresh Baked HOMEKit-made Cookles – With a DarkHotel Overlap
Threat actors tend to reuse certain tools, a trend we observed during recent Unit 42 research published on MNKit. In this post, we will discuss a fresh toolkit, which on the surfac...
Palo Alto Networks News of the Week – July 30, 2016
Unit 42 had a busy week! Researchers Robert Falcone and Jen Miller-Osborn observed a 9002 Trojan delivered using a combination of shortened links and a shared file hosted on Google Drive.
SpyNote Android Trojan Builder Leaked
Our team recently discovered a new Android Trojan called SpyNote which facilitates remote spying. The builder, which creates new versions of the malware, recently leaked on several malware discussion forums. SpyNote is similar to OmniRat an...
Attack Delivers ‘9002’ Trojan Through Google Drive
Unit 42 recently observed a 9002 Trojan delivered using a combination of shortened links and a shared file hosted on Google Drive. The delivery method also uses an actor-controlled server hosting a custom redir...
Technical Walkthrough: Office Test Persistence Method Used In Recent Sofacy...
As mentioned in our previous blog, we observed the Sofacy group using a new persistence mechanism that we call “Office Test” to load their Trojan each...
Investigating the LuminosityLink Remote Access Trojan Configuration
In recent weeks, I’ve spent time investigating the LuminosityLink Remote Access Trojan’s (RAT) embedded configuration. For those unaware, LuminosityLi...
New Sofacy Attacks Against US Government Agency
The Sofacy group, also known as APT28, is a well-known threat group that frequently conducts cyber espionage campaigns. Recently, Unit 42 identified a spear phishing e-mail from the Sofacy group that targeted t...
ProjectM: Link Found Between Pakistani Actor and Operation Transparent Trib...
Be the first to receive the latest news, cyber threat intelligence and research from Unit 42. Subscribe Now.
AceDeceiver: First iOS Trojan Exploiting Apple DRM Design Flaws to Infect A...
We’ve discovered a new family of iOS malware that successfully infected non-jailbroken devices we’ve named “AceDeceiver”.
New Malware 'Rover' Targets Indian Ambassador to Afghanistan
On December 24, 2015, Unit 42 identified a targeted attack, delivered via email, on a high profile Indian diplomat, an Ambassador to Afghanistan. The...
New Android Trojan “Xbot” Phishes Credit Cards and Bank Accounts, Encrypts ...
We recently discovered 22 Android apps that belong to a new Trojan family we’re calling “Xbot”. This Trojan, which is still under development and regu...
Palo Alto Networks News of the Week – February 6
In a new study released this week, Palo Alto Networks partnered with the Ponemon Institute to understand not only what motivates cyberattackers but also how we can turn the tables on them by taking away their f...
NetTraveler Spear-Phishing Email Targets Diplomat of Uzbekistan
Unit 42 recently identified a targeted attack against an individual working for the Foreign Ministry of Uzbekistan in China. A spear-phishing email wa...
iOS Trojan “TinyV” Attacks Jailbroken Devices
In October 2015, we discovered a malicious payload file targeting Apple iOS devices. After investigating, we believe the payload belongs to a new iOS Trojan family that we’re calling “TinyV”. In December 2015,...
Bookworm Trojan: A Model of Modular Architecture
Recently, while researching attacks on targets in Thailand, Unit 42 discovered a tool that initially appeared to be a variant of the well-known PlugX RAT based on similar observed behavior such as the usage of...
Subscribe to the Blog!
Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more.
By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement. Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder.